Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response.
This issue is fixed in version 2.14.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
scrapy:scrapy
References 4
https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5
security-advisories@github.com
https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0
security-advisories@github.com
https://github.com/scrapy/scrapy/releases/tag/2.14.2
security-advisories@github.com
https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7
security-advisories@github.com