{
"id": "GHSA-823f-cwm9-4g74",
"aliases": [
"CVE-2021-41124"
],
"details": "### Impact\n\nIf you use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for Splash authentication, any non-Splash request will expose your credentials to the request target. This includes `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`.\n\n### Patches\n\nUpgrade to scrapy-splash 0.8.0 and use the new `SPLASH_USER` and `SPLASH_PASS` settings instead to set your Splash authentication credentials safely.\n\n### Workarounds\n\nIf you cannot upgrade, set your Splash request credentials on a per-request basis, [using the `splash_headers` request parameter](https://github.com/scrapy-plugins/scrapy-splash/tree/0.8.x#http-basic-auth), instead of defining them globally using the [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth).\n\nAlternatively, make sure all your requests go through Splash. That includes disabling the [robots.txt middleware](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#topics-dlmw-robots).\n\n### For more information\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/scrapy-plugins/scrapy-splash/issues)\n* [Email us](mailto:[email protected] )\n",
"summary": "Splash authentication credentials potentially leaked to target websites ",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.0"
}
]
}
],
"package": {
"name": "scrapy-splash",
"ecosystem": "PyPI"
}
}
],
"modified": "2024-10-26T22:52:44Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
}
],
"published": "2021-10-06T17:49:23Z",
"references": [
{
"url": "https://github.com/scrapy-plugins/scrapy-splash/security/advisories/GHSA-823f-cwm9-4g74",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41124",
"type": "ADVISORY"
},
{
"url": "https://github.com/scrapy-plugins/scrapy-splash/commit/2b253e57fe64ec575079c8cdc99fe2013502ea31",
"type": "WEB"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/scrapy-splash/PYSEC-2021-364.yaml",
"type": "WEB"
},
{
"url": "https://github.com/scrapy-plugins/scrapy-splash",
"type": "PACKAGE"
},
{
"url": "https://github.com/scrapy-plugins/scrapy-splash/releases/tag/0.8.0",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-10-05T21:15:00Z",
"github_reviewed_at": "2021-10-05T21:11:11Z"
}
}