id: PYSEC-2024-258
modified: 2025-07-15T17:37:50.051730Z
published: 2024-05-20T08:15:08Z
aliases:
- CVE-2024-1968
- GHSA-4qqq-9vqf-3h3f
details: In scrapy/scrapy, an issue was identified where the Authorization header
  is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP)
  but remain within the same domain. This behavior contravenes the Fetch standard,
  which mandates the removal of Authorization headers in cross-origin requests when
  the scheme, host, or port changes. Consequently, when a redirect downgrades from
  HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext,
  leading to potential sensitive information disclosure to unauthorized actors. The
  flaw is located in the _build_redirect_request function of the redirect middleware.
affected:
- package:
    ecosystem: PyPI
    name: scrapy
    purl: pkg:pypi/scrapy
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 1d0502f25bbe55a22899af915623fda1aaeb9dd8
    repo: https://github.com/scrapy/scrapy
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.0.0
    - introduced: 2.0.0
    - fixed: 2.11.2
  versions:
  - 0.10.4.2364
  - 0.12.0.2550
  - 0.14.1
  - 0.14.2
  - 0.14.3
  - 0.14.4
  - 0.16.0
  - 0.16.1
  - 0.16.2
  - 0.16.3
  - 0.16.4
  - 0.16.5
  - 0.18.0
  - 0.18.1
  - 0.18.2
  - 0.18.3
  - 0.18.4
  - 0.20.0
  - 0.20.1
  - 0.20.2
  - 0.22.0
  - 0.22.1
  - 0.22.2
  - 0.24.0
  - 0.24.1
  - 0.24.2
  - 0.24.3
  - 0.24.4
  - 0.24.5
  - 0.24.6
  - "0.7"
  - "0.8"
  - "0.9"
  - 1.0.0
  - 1.0.0rc1
  - 1.0.0rc2
  - 1.0.0rc3
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.1.0
  - 1.1.0rc1
  - 1.1.0rc2
  - 1.1.0rc3
  - 1.1.0rc4
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.4.0
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.10.0
  - 2.10.1
  - 2.11.0
  - 2.11.1
  - 2.2.0
  - 2.2.1
  - 2.3.0
  - 2.4.0
  - 2.4.1
  - 2.5.0
  - 2.5.1
  - 2.6.0
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.7.0
  - 2.7.1
  - 2.8.0
  - 2.9.0
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a
- type: FIX
  url: https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aaeb9dd8
- type: WEB
  url: https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a
- type: ADVISORY
  url: https://github.com/advisories/GHSA-4qqq-9vqf-3h3f