Exposure of Sensitive Information in Scrapy by Scrapy Project
CVE-2024-1968
Currently unrated
What is CVE-2024-1968?
A vulnerability has been identified in Scrapy where the Authorization header remains intact during redirects that switch between HTTPS and HTTP on the same domain. This flaw violates the Fetch standard, which requires the removal of Authorization headers in cross-origin requests when there is a change in the scheme, host, or port. As a result, this vulnerability could lead to the unintended disclosure of sensitive information in plaintext to unauthorized users, particularly when the redirect de-escalates security from HTTPS to HTTP. The issue is rooted within the _build_redirect_request function of Scrapy's redirect middleware.