CVE-2023-43804

urllib3 cookie leak via redirects

• CVSS 8.1
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• Configuration Issues
• Remote

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

CVE

CVE-2023-43804

CWE

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSS base score

8.1

Published

2023-10-04

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Open Redirects

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update urllib3 to version 1.26.17 or 2.0.5.

import urllib3

http = urllib3.PoolManager()

response = http.request('GET', 'http://example.com', headers={'Cookie': 'session_id=12345'})

print(response.data)

import urllib3

http = urllib3.PoolManager()

response = http.request('GET', 'http://example.com', headers={'Cookie': 'session_id=12345'}, redirect=False)

print(response.data)

@misc{vaitp:cve202343804,
  title        = {{urllib3 cookie leak via redirects}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-43804},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-43804/}}
}