CVE-2014-1829

What it actually does

The vulnerability lies in the handling of HTTP redirects. When an application using a vulnerable version of the python-requests library authenticates to a server using credentials from a .netrc file, and that server responds with a redirect to a different domain, the library incorrectly forwards the 'Authorization' header to the new domain. This exposes the authentication credentials to the server at the redirected location.

Why it matters to the business

Exposure of authentication credentials can lead to unauthorized access to sensitive systems and data. If these credentials are reused across different services, it could allow an attacker to compromise multiple systems, leading to data breaches, operational disruption, and reputational damage.

How an attack unfolds

An attacker would first need to entice a client application, which uses a vulnerable version of the python-requests library, to connect to a server under their control. The client application would send a request with an 'Authorization' header for authentication. The attacker's server would then respond with an HTTP redirect (e.g., status code 301 or 302) pointing to a second domain, also controlled by the attacker. The vulnerable client library would follow this redirect and improperly re-send the original 'Authorization' header to the new domain. The attacker, by logging requests on their second server, can capture the header and steal the user's credentials.

How to fix it

Upgrade the python-requests library to version 2.3.0 or later. This version correctly strips the 'Authorization' header when following cross-domain redirects. Use your system's package manager to update the library (e.g., 'pip install --upgrade requests'). Ensure all application dependencies are updated to use the patched version.

How to confirm the fix worked

To validate the fix, check the version of the python-requests library installed in all relevant environments and applications. Ensure it is 2.3.0 or newer. You can write a test script that makes an authenticated request to a controlled server that issues a cross-domain redirect. Then, inspect the request received by the destination server to confirm that the 'Authorization' header is no longer present.

Typical attack path

1. An attacker sets up a malicious web server configured to issue HTTP redirects to another attacker-controlled domain.
2. A victim application using a vulnerable version of python-requests makes an authenticated request to the attacker's initial server.
3. The attacker's server responds with a redirect to a different domain.
4. The vulnerable client application follows the redirect and sends the original 'Authorization' header containing credentials to the new domain.
5. The attacker's second server receives the request and logs the 'Authorization' header, capturing the credentials.

How to detect it

Detecting past exploitation is difficult as it requires visibility into network traffic or application logs. Look for logs from applications using python-requests that show connections to a primary domain followed immediately by a connection to an unexpected or unrelated domain due to an HTTP redirect. Full packet captures (PCAPs) could be analyzed to find instances where an 'Authorization' header was sent to a second domain after a redirect from a different first domain.

What your security team should do

• Identify all applications and systems using the python-requests library and determine their versions.
• Prioritize upgrading all instances of python-requests to version 2.3.0 or later, especially on systems that connect to external, untrusted endpoints.
• Review application code to ensure that sensitive credentials are not being sent to untrusted domains and consider disabling automatic redirect following where not strictly necessary.