oss-sec mailing list archives
CVE Request for python-requests session fixation vulnerability
From: Ian Cordasco <graffatcolmingov () gmail com>
Date: Sat, 14 Mar 2015 11:50:48 -0500
Last night, Matthew Daley (CC'd on this email) privately disclosed to the requests project a vulnerability in requests which has now been fixed in requests v2.6.0 (https://warehouse.python.org/project/requests/2.6.0/) by this commit: https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc. The following is the relevant excerpts from the description provided by Matthew: The issue occurs when Requests is handling a HTTP response that is a redirection and that also sets cookies without an explicit domain parameter. Instead of the cookies only being set for the domain which sent the HTTP response, they are also sent to the redirection target, regardless of its domain. The issue could be exploited in the following ways: * If you are the redirection source (ie. you can make Requests hit your URL), you can make Requests perform a request to any third-party domain with cookies of your choosing. This may be useful in performing a session fixation attack. * If you are the redirection target (ie. you can make a third-party site redirect to your URL), you are able to steal any cookies set by the third-party redirection. The change that introduced this vulnerability was first included in version 2.1.0 of requests. As such every version since that version up to and including 2.5.3 are vulnerable to this attack. Please assign an identifier for this. Thank you, Ian Cordasco
Current thread:
- CVE Request for python-requests session fixation vulnerability Ian Cordasco (Mar 14)
- Re: CVE Request for python-requests session fixation vulnerability cve-assign (Mar 14)