Information Disclosure in scrapy (CVE-2022-0577)
Summary
Vulnerability in scrapy (CVE-2022-0577). Risk of unauthorized operations or information disclosure. Exploitable via Request. Mitigation: upgrade to 2.6.0 or later.
Original description
The description as published by the source.
Impact
If you manually define cookies on a Request object, and that Request object gets a redirect response, the new Request object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.
Patches
Upgrade to Scrapy 2.6.0, which resets cookies when creating Request objects to follow redirects¹, and drops the Cookie header if manually-defined if the redirect target URL domain name does not match the source URL domain name².
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.
¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.
² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.
Workarounds
If you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the Request documentation, and set the right domain fo…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2022-0577 has been found in scrapy.
Attackers can target a specific entry point like Request over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade scrapy to 2.6.0 or later.
If unsure, ask your IT team or search "scrapy CVE-2022-0577" on the vendor's site.
CVE-2022-0577 (scrapy) — CWE-200
Attack surface: Request / Cookie
Patched: 2.6.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Information disclosure (CWE-200) exists in scrapy. Attackers reach the vulnerable code path via Request.
Check the vendor advisory for the affected versions of scrapy. Attack surface: Request / Cookie.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 2.6.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'scrapy' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'scrapy' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
scrapyを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade scrapy to 2.6.0ステージング環境で 2.6.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-0577 python-scrapy Fixed in: 2.4.1-2+deb11u1
References
- web github.com
- web github.com
- web nvd.nist.gov
- web huntr.dev
- web lists.debian.org
- web github.com
- web github.com