Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2024-47081: Netrc credential leak in PSF requests library

seclists.org

Post reply on HN
Print view View original

21–28 of 28 posts

Re: CVE-2024-47081: Netrc credential leak in PSF requests library

#21

Post by edelbitter »

w7 wrote: post #13
woodruffw wrote: post #7

Another good example of lax URL parsing/parser differentials being problematic. That being said, I wonder how big the actual impact here is in practice: how many users actually use .netrc? I’ve been using curl and other network tools for well over a decade and I don’t think I’ve ever used .netrc for site credentials.

I think it may be in use by tools without people being aware. I decided to check my workstation for it just in case, figuring the file would be empty, or not exist. Instead it seems to be populated with what seem to be Heroku API and git credentials.

Well then go check if you are for some reason using any of the other surprise features [1], like honoring the CURL_CA_BUNDLE env variable, or not honoring the PROXIES env variable if REQUEST_METHOD is set.

1: https://requests.readthedocs.io/en/latest/api/#requests.Sess...

Re: CVE-2024-47081: Netrc credential leak in PSF requests library

#24

Post by sionisrecur »

zx8080 wrote: post #22

A funny commit message in the root cause (as stated in the linked post) commit: > Push code review advice from @sigmavirus24

To be fair, the advice from sigmavirus24 was about dealing with decoding the ':' character: https://github.com/psf/requests/pull/2936/files

The code already had `host = ri.netloc.split(':')[0]` before that.

The actual root issue is urlparse doesn't split the host, user, pass and port and trying to do it manually is very error prone:

    urllib.parse.urlparse('http://example.com:@evil.com:8080/')
    ParseResult(scheme='http', netloc='example.com:@evil.com:8080', path='/', params='', query='', fragment='')
Compare this with php:

    parse_url ('http://example.com:@evil.com:8080/')
    [
        "scheme" => "http",
        "host" => "evil.com",
        "port" => 8080,
        "user" => "example.com",
        "pass" => "",
        "path" => "/",
    ]

Re: CVE-2024-47081: Netrc credential leak in PSF requests library

#26

Post by progbits »

Daviey wrote: post #12

Well, it's probably just a coincidence, but I literally just spun up a web service that is vulnerable to this: https://isitup.daviey.com/ The code doesn't make any reference to a .netrc, but I happen to have one in ~/.netrc: machine localhost login *REDACTED* password CTF{*REDACTED*} It's not ideal that requests automatically slurps credentials from ~/.netrc and leaks them, even when my code never references it. It's…

Edit: Comment removed on request of parent.

Re: CVE-2024-47081: Netrc credential leak in PSF requests library

#27

Post by Daviey »

progbits wrote: post #26
Daviey wrote: post #12

Well, it's probably just a coincidence, but I literally just spun up a web service that is vulnerable to this: https://isitup.daviey.com/ The code doesn't make any reference to a .netrc, but I happen to have one in ~/.netrc: machine localhost login *REDACTED* password CTF{*REDACTED*} It's not ideal that requests automatically slurps credentials from ~/.netrc and leaks them, even when my code never references it. It's…

Edit: Comment removed on request of parent.

Well done for solving it.. but I'd have preferred you had not shared the solution, it's against the spirit of these sorts of things, but I can't stop you. :)

EDIT: I do appreciate you removing the solution. Have a great day.

Re: CVE-2024-47081: Netrc credential leak in PSF requests library

#28

Post by kidmin »

sionisrecur wrote: post #24
zx8080 wrote: post #22

A funny commit message in the root cause (as stated in the linked post) commit: > Push code review advice from @sigmavirus24

To be fair, the advice from sigmavirus24 was about dealing with decoding the ':' character: https://github.com/psf/requests/pull/2936/files The code already had `host = ri.netloc.split(':')[0]` before that. The actual root issue is urlparse doesn't split the host, user, pass and port and trying to do it manually is very error prone: urllib.parse.urlparse('http://example.com:@evil.com:8080/') ParseResult(scheme='http'…

and it is from the beginning: https://github.com/psf/requests/commit/79bb9ee1417afe2231972...
Post reply on HN