CVE-2024-37891

Executive Summary

CVE-2024-37891 is a low-severity information disclosure vulnerability in the urllib3 Python library. The flaw occurs when a user manually sets the Proxy-Authorization HTTP header without using urllib3's built-in proxy support (ProxyManager). In such cases, urllib3 does not treat this header as authentication material and fails to strip it during cross-origin redirects. This could leak proxy credentials to a malicious origin if all of the following conditions are met: the user manually sets the header, does not disable HTTP redirects, and either uses an HTTP origin server or the proxy/target redirects to a malicious server. The CVSS score is 4.4 (Medium), but the EPSS score is 0.0%, indicating very low exploitation likelihood. The vendor has released patches in versions 1.26.19 and 2.2.2.

Supply Chain & Package Security

This vulnerability affects the urllib3 Python package, which is a critical dependency in the Python ecosystem. It is used by popular libraries such as requests, pip, and many others. Organizations using urllib3 in their supply chain should verify their dependency versions and update to patched releases. The vulnerability is not exploitable via package manager injection but requires specific misconfiguration by the developer.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – requires specific misconfiguration and redirect chain
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – attacker must trick user into following redirect
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential leak of proxy credentials
• Integrity Impact: Low (I:L) – possible credential reuse
• Availability Impact: None (A:N)
• Threat Level: Low – due to high complexity and low EPSS score

Deep Dive & Mechanics

The vulnerability stems from urllib3's handling of the Proxy-Authorization header. When using ProxyManager, the library correctly manages proxy authentication and strips the header on redirects. However, if a developer manually sets the Proxy-Authorization header in a request (e.g., via headers={"Proxy-Authorization": "Basic ..."}) without using ProxyManager, urllib3 does not recognize it as authentication material. During a cross-origin redirect, the header is forwarded to the new origin, potentially leaking credentials.

The attack chain requires:

1. The victim application sets Proxy-Authorization header manually.
2. The request is sent to an HTTP origin or a proxy that redirects to a malicious origin.
3. The malicious origin receives the Proxy-Authorization header.

The fix in versions 1.26.19 and 2.2.2 automatically strips the Proxy-Authorization header on any cross-origin redirect, regardless of how it was set.

Vulnerable vs. Patched Code

Vulnerable Code (urllib3 < 1.26.19 / < 2.2.2):

import urllib3

http = urllib3.PoolManager()
# Manually setting Proxy-Authorization header
headers = {"Proxy-Authorization": "Basic dXNlcjpwYXNz"}
response = http.request("GET", "http://example.com", headers=headers)
# If example.com redirects to http://evil.com, the header is forwarded

Patched Code (urllib3 >= 1.26.19 / >= 2.2.2):

import urllib3

http = urllib3.PoolManager()
headers = {"Proxy-Authorization": "Basic dXNlcjpwYXNz"}
response = http.request("GET", "http://example.com", headers=headers)
# The library now automatically strips Proxy-Authorization on cross-origin redirects

The patch adds logic to remove the Proxy-Authorization header from the request when a redirect crosses origins.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python environment with urllib3 < 1.26.19 or < 2.2.2
• A malicious HTTP server that logs incoming headers
• A legitimate HTTP server that redirects to the malicious server

Exploitation Steps:

1. Set up a malicious HTTP server (e.g., using Python's http.server or a tool like nc).
2. Set up a legitimate HTTP server that returns a 302 redirect to the malicious server.
3. Craft a Python script that sends a request with a manually set Proxy-Authorization header to the legitimate server.
4. Observe the malicious server logs to capture the leaked header.

Example Script:

import urllib3

http = urllib3.PoolManager()
headers = {"Proxy-Authorization": "Basic dXNlcjpwYXNz"}
# Replace with your redirect server URL
response = http.request("GET", "http://legitimate-server.com/redirect", headers=headers)
print(response.data)

Blue Team

Detection:

• Monitor for requests containing Proxy-Authorization headers that are not associated with proxy usage.
• Look for cross-origin redirects where the Proxy-Authorization header is present in the request.
• Use network traffic analysis to detect unusual header forwarding.

Mitigation:

• Update urllib3 to version 1.26.19 or 2.2.2.
• Enforce the use of ProxyManager for proxy authentication.
• Disable automatic redirects (redirects=False) when manually setting proxy headers.
• Implement network segmentation to prevent credential leakage.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing Proxy-Authorization header followed by a cross-origin redirect.
• Logs: Server logs showing Proxy-Authorization header in requests to unexpected origins.
• File: Python scripts using urllib3 with manually set Proxy-Authorization headers.
• Behavior: Unexpected credential reuse or authentication attempts from redirected origins.

Detection Engineering

YARA Rule

rule CVE_2024_37891_Urllib3_ProxyAuth_Leak {
    meta:
        description = "Detects urllib3 code that manually sets Proxy-Authorization header"
        author = "Valters IT"
        date = "2025-04-16"
        reference = "CVE-2024-37891"
    strings:
        $header = "Proxy-Authorization" nocase
        $urllib3 = "urllib3" nocase
        $request = "request" nocase
    condition:
        $urllib3 and $header and $request
}

Sigma Rule

title: CVE-2024-37891 - urllib3 Proxy-Authorization Header Leak
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with Proxy-Authorization header followed by cross-origin redirect
author: Valters IT
date: 2025-04-16
logsource:
    category: network
    product: suricata
detection:
    selection:
        http.request_header: "Proxy-Authorization"
        http.response_code: 301|302|307|308
    condition: selection
falsepositives:
    - Legitimate proxy usage with ProxyManager
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37891 - urllib3 Proxy-Authorization Header Leak"; flow:to_server; content:"Proxy-Authorization"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade urllib3 to version 1.26.19 or 2.2.2.
2. If upgrade is not possible, disable automatic redirects (redirects=False) when manually setting Proxy-Authorization headers.
3. Use urllib3's ProxyManager for all proxy authentication.

Long-term Measures:

• Implement code reviews to ensure proxy headers are not set manually.
• Use static analysis tools to detect manual Proxy-Authorization header usage.
• Monitor for unusual redirect chains in network traffic.

Workarounds:

• Avoid using the Proxy-Authorization header directly; use ProxyManager instead.
• Set redirects=False in all requests that include custom authentication headers.

Valters IT
Securing Digital Frontiers