Information Exposure Through Sent Data Affecting urllib3 package, versions [,1.26.18) [2.0.0,2.0.7)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-URLLIB3-6002459
- published 18 Oct 2023
- disclosed 17 Oct 2023
- credit ranjit-git, Illia Volochii, Seth Michael Larson
Introduced: 17 Oct 2023
CVE-2023-45803 Open this link in a new tabHow to fix?
Upgrade urllib3 to version 1.26.18, 2.0.7 or higher.
Overview
urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.
Affected versions of this package are vulnerable to Information Exposure Through Sent Data when it processes HTTP redirects with a 303 status code, due to not stripping the request body when changing the request method from POST to GET. An attacker can potentially expose sensitive information by compromising the origin service and redirecting requests to a malicious peer.
Note:
This is only exploitable if sensitive information is being submitted in the HTTP request body and the origin service is compromised, starting to redirect using 303 to a malicious peer or the redirected-to service becomes compromised.
Workaround
This vulnerability can be mitigated by disabling redirects for services that are not expected to respond with redirects, or disabling automatic redirects and manually handling 303 redirects by stripping the HTTP request body.