CVE-2022-21712

Twisted Python exposes cookies and authorization headers in cross-origin redirects, affecting RedirectAgent and BrowserLikeRedirectAgent functions

• CVSS 7.5
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• Information Leakage
• Remote

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

CVE

CVE-2022-21712

CWE

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSS base score

7.5

Published

2022-02-07

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Twisted to a version that fixes the vulnerability.

from twisted.web.client import RedirectAgent
from twisted.web.http import Headers

class ModifiedRedirectAgent(RedirectAgent):
    def _followRedirect(self, response, request, uri, headers):
        return super()._followRedirect(response, request, uri, headers)

from twisted.web.client import RedirectAgent
from twisted.web.http import Headers

class ModifiedRedirectAgent(RedirectAgent):
    def __init__(self, reactor, contextFactory, *args, **kwargs):
        super().__init__(reactor, contextFactory, *args, **kwargs)

    def _followRedirect(self, response, request, uri, headers):
        if self._isCrossOriginRedirect(request, uri):
            headers = Headers({b'cookie': [], b'authorization': []})
        return super()._followRedirect(response, request, uri, headers)

    def _isCrossOriginRedirect(self, request, uri):
        request_origin = request.getHost()
        redirect_origin = uri.host
        return request_origin != redirect_origin

@misc{vaitp:cve202221712,
  title        = {{Twisted Python exposes cookies and authorization headers in cross-origin redirects, affecting RedirectAgent and BrowserLikeRedirectAgent functions}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-21712},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-21712/}}
}