Executive brief
urllib3 is a widely-used Python HTTP client library. Under a narrow set of circumstances, the Proxy-Authorization header containing proxy credentials is not stripped when urllib3 automatically follows HTTP redirects to different origins, potentially exposing authentication material to malicious redirect destinations. This requires misconfiguration (manually setting Proxy-Authorization without using urllib3's proxy features) and specific redirect conditions to trigger.
Technical details
The vulnerability is an improper authentication material handling issue (CWE-669) in urllib3's redirect logic. When the Proxy-Authorization header is manually configured on a request (rather than set automatically by urllib3's ProxyManager), the library does not treat it as authentication material and therefore does not strip it during cross-origin HTTP redirects. An attacker must establish conditions where: (1) the application manually sets Proxy-Authorization without using urllib3's built-in proxy support, (2) automatic redirects are not disabled, and (3) an attacker can control a redirect target on the same protocol or trick the server into redirecting to a malicious origin. The patch adds logic to strip Proxy-Authorization headers on cross-origin redirects regardless of configuration. Affected versions: urllib3 ≤1.26.18 and ≤2.2.1; patched in 1.26.19 and 2.2.2.
Affected products
- urllib3 urllib3 <=1.26.18, <=2.2.1
Timeline
- 2024-06-17: disclosed
- 2024-06-17: patched: urllib3 1.26.19 and 2.2.2