Is CVE-2022-0577 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0577 being exploited in the wild.

How severe is CVE-2022-0577?

Medium severity, with a CVSS score of 6.5, published 1 March 2022.

Which products and versions are affected?

scrapy (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.2, GIT:introduced=0,fixed=8ce01b3b76d4634f55067d6cfdf632ec70ba304a|ECOSYSTEM:introduced=0,fixed=2.6.1.

Is there a fix for CVE-2022-0577?

Yes. scrapy (PyPI): upgrade to 1.8.2, 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0577 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-0577?

Check whether you run scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0577: Scrapy cookie leakage across redirect domains

CVE-2022-0577 · Severity: medium · CVSS 6.5 · Published 2022-03-01

Scrapy is a popular web scraping framework. When a web server redirects a request to a different domain, Scrapy was incorrectly carrying forward manually-defined cookies to the new domain. This could expose sensitive authentication tokens or session cookies to unintended third-party websites, potentially allowing attackers to hijack accounts or scrape data they shouldn't access.

Technologies: scrapy (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-0577 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0577 being exploited in the wild.
How severe is CVE-2022-0577?: Medium severity, with a CVSS score of 6.5, published 1 March 2022.
Which products and versions are affected?: scrapy (PyPI) ECOSYSTEM:introduced=0,fixed=1.8.2, GIT:introduced=0,fixed=8ce01b3b76d4634f55067d6cfdf632ec70ba304a|ECOSYSTEM:introduced=0,fixed=2.6.1.
Is there a fix for CVE-2022-0577?: Yes. scrapy (PyPI): upgrade to 1.8.2, 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0577 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-0577?: Check whether you run scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

scrapy (PyPI): upgrade to 1.8.2, 2.6.1 or later
```
pip install "scrapy>=2.6.1"
```

Technical details

The vulnerability is an authorization and information disclosure issue in Scrapy's request handling. When a Request object with manually-defined cookies receives a redirect (HTTP 301/302/etc.), the cookie middleware fails to restrict those cookies to their intended domain and instead passes them to the redirect target domain regardless of domain mismatch. An attacker can trick a scraper into following a redirect to an attacker-controlled domain and capture the leaked cookies. The issue affects Scrapy versions before 2.6.0 (and 1.8.2 for the 1.x branch). Patches reset cookies on redirect and drop manually-defined cookies if domain names do not match.

Affected products

Scrapy Scrapy before 2.6.0 (and before 1.8.2 in the 1.x branch)

Identifiers

CVE-2022-0577
GHSA-cjvr-mfj7-j4j8
PYSEC-2022-159

Timeline

2022-03-01: disclosed
2022: patched: Version 2.6.0 and 1.8.2 released with fix

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.