CVE-2023-32681 Explained : Impact and Mitigation

Unintended leak of Proxy-Authorization header in requests.

Understanding CVE-2023-32681

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use

rebuild_proxies

to reattach the

Proxy-Authorization

header to requests.

What is CVE-2023-32681?

CVE-2023-32681 involves an unintentional leak of the Proxy-Authorization header in requests made using the Requests library. Due to this vulnerability, sensitive information may be exposed to unauthorized actors when communicating with destination servers.

The Impact of CVE-2023-32681

The impact of CVE-2023-32681 is considered medium with a base score of 6.1. It can result in a high confidentiality impact, potentially allowing malicious actors to access sensitive information unintentionally forwarded in the Proxy-Authorization header.

Technical Details of CVE-2023-32681

In Requests library version 2.3.0 to less than 2.31.0, the Proxy-Authorization header is leaked when redirected to an HTTPS endpoint. The vulnerability affects the confidentiality of information shared over HTTPS connections.

Vulnerability Description

The issue arises from the forwarding of proxy credentials to the destination server when requests are made over HTTPS, leading to the unintentional exposure of sensitive information.

Affected Systems and Versions

The vulnerability affects Requests library versions greater than or equal to 2.3.0 and less than 2.31.0.

Exploitation Mechanism

The vulnerability allows malicious actors to potentially exfiltrate sensitive information by exploiting the leaking of Proxy-Authorization headers during redirection to HTTPS endpoints.

Mitigation and Prevention

To address CVE-2023-32681, it is crucial to take immediate steps and adopt long-term security practices to prevent unauthorized access to sensitive information.

Immediate Steps to Take

Users are advised to update their Requests library to version 2.31.0 or newer to mitigate the vulnerability. Avoid making requests to HTTPS endpoints using affected versions.

Long-Term Security Practices

Implement strong authentication mechanisms and access controls to prevent unauthorized access to sensitive information in HTTP requests.

Patching and Updates

Stay informed about security patches and updates released by the Requests library to address vulnerabilities and enhance security measures.