CVE-2024-47081: 
Python Analyse et atténuation des vulnérabilités

The Python Requests library (versions prior to 2.32.4) contains a URL parsing vulnerability identified as CVE-2024-47081. The vulnerability allows the leakage of .netrc credentials to third parties when processing specific maliciously-crafted URLs. The issue was discovered on September 12, 2024, and a fix was released in version 2.32.4 (GitHub Advisory, Full Disclosure).

The vulnerability stems from incorrect URL processing in the Requests library. When making requests to URLs with a specific format (e.g., 'http://example.com:@evil.com/'), the library incorrectly handles the netloc parsing, causing it to leak .netrc credentials configured for the first domain to the second domain. The root cause was identified in the URL parsing logic of the library. The vulnerability has been assigned a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (GitHub Advisory).

When exploited, this vulnerability can lead to the exposure of sensitive .netrc credentials to unauthorized third parties. This is particularly concerning in scenarios where web scrapers or other automated systems process user-provided URLs while having .netrc credentials configured. The impact is heightened in cases where the credentials might be reused across different services or systems (OSS Security).

Users are advised to upgrade to Requests version 2.32.4 which contains the fix for this vulnerability. For those unable to upgrade immediately, a workaround is available by disabling .netrc access using 'trust_env=False' on the Requests Session. Additionally, explicitly specifying credentials on every API call can prevent the use of .netrc credentials (GitHub Advisory).

The security community has actively discussed the implications of this vulnerability, particularly focusing on its impact on web scrapers and automated systems. Security researchers have noted that while the vulnerability requires specific conditions to exploit, its presence in such a widely-used library makes it significant. Some researchers have created proof-of-concept demonstrations to highlight the potential risks (OSS Security).