Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 14 May 2024.

Which products and versions are affected?

scrapy (PyPI) ECOSYSTEM:introduced=0,fixed=2.11.2.

Is there a fix for This vulnerability?

Yes. scrapy (PyPI): upgrade to 2.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Scrapy insecure redirect handling in non-HTTP protocols

Severity: low · CVSS 3.1 · Published 2024-05-14

Scrapy, a popular web scraping framework, incorrectly follows HTTP redirects for non-HTTP protocols like file://, ftp://, and s3://. An attacker with the ability to control a spider's start URLs could exploit this to redirect requests to local files, malicious FTP servers, or cloud storage, potentially exposing sensitive credentials or local data that the spider processes.

Technologies: scrapy (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 14 May 2024.
Which products and versions are affected?: scrapy (PyPI) ECOSYSTEM:introduced=0,fixed=2.11.2.
Is there a fix for This vulnerability?: Yes. scrapy (PyPI): upgrade to 2.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run scrapy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

scrapy (PyPI): upgrade to 2.11.2 or later
```
pip install "scrapy>=2.11.2"
```

Technical details

Scrapy's redirect middleware (RedirectMiddleware and MetaRefreshMiddleware) follows HTTP redirects indiscriminately across all URL protocols (file://, ftp://, s3://, data://, etc.) instead of restricting them to http:// and https:// schemes. An attacker with write access to spider start_urls and read access to spider output can chain redirects to exfiltrate sensitive data: file:// redirects expose local files, ftp:// redirects can capture FTP credentials, and s3:// redirects can access cloud storage using configured S3 credentials. The vulnerability is network-reachable and requires low privilege (ability to define start URLs). The fix, available in Scrapy 2.11.2, restricts redirect following to HTTP/HTTPS only.

Affected products

Scrapy Scrapy < 2.11.2

Timeline

2024-05-14: disclosed
2024-05-14: patched: Fixed in Scrapy 2.11.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.