Executive brief
Scrapy is a popular web scraping framework. When a web server redirects a request to a different domain, Scrapy was incorrectly carrying forward manually-defined cookies to the new domain. This could expose sensitive authentication tokens or session cookies to unintended third-party websites, potentially allowing attackers to hijack accounts or scrape data they shouldn't access.
Technical details
The vulnerability is an authorization and information disclosure issue in Scrapy's request handling. When a Request object with manually-defined cookies receives a redirect (HTTP 301/302/etc.), the cookie middleware fails to restrict those cookies to their intended domain and instead passes them to the redirect target domain regardless of domain mismatch. An attacker can trick a scraper into following a redirect to an attacker-controlled domain and capture the leaked cookies. The issue affects Scrapy versions before 2.6.0 (and 1.8.2 for the 1.x branch). Patches reset cookies on redirect and drop manually-defined cookies if domain names do not match.
Affected products
- Scrapy Scrapy before 2.6.0 (and before 1.8.2 in the 1.x branch)
Timeline
- 2022-03-01: disclosed
- 2022: patched: Version 2.6.0 and 1.8.2 released with fix