https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 17:09:40 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-107715 <p>The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.</p> <p>The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-107715 https://vulnerability.circl.lu/vuln/ghsa-2mwr-xjcg-37j7 <p><strong>Affected:</strong> RubyGems: mechanize</p> <p>## Summary</p> <p>`mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credentials set through `Mechanize#request_headers=` leaked even when they were `Authorization`.</p> <p>## Details</p> <p>Two defects, both in `lib/mechanize/http/agent.rb`.</p> <p>**1. `Mechanize#request_headers=` bypassed the redirect strip entirely.** `#request_add_headers` copied `@request_headers` onto every request unconditionally, with no host check, including the request issued after a redirect. The strip in `#response_redirect` mutated only the per-request headers hash and never touched agent state. Because `request_headers=` is the documented way to set a default credential for every request, the header the code explicitly protected — `Authorization` — was the one most likely to leak.</p> <p>**2. The strip list omitted `Proxy-Authorization` and `Cookie2`.** Only `CREDENTIAL_HEADERS = [&#39;Authorization&#39;]` and `COOKIE_HEADERS = [&#39;Cookie&#39;]` were removed from the per-request headers hash on a cross-host redirect.</p> <p>Cookies held in `Mechanize#cookie_jar` and credentials held in `Mechanize::HTTP::AuthStore` are **not** affected. Both are looked up per-URI, so they never follow a redirect to a foreign host. The exposure was limited to headers the caller set by hand.</p> <p>## PoC</p> <p>```ruby agent = Mechanize.new agent.request_headers = { &#39;Authorization&#39; =&gt; &#39;Bearer secret&#39; } agent.get(&#39;https://example.test/redirects-to-attacker&#39;) # the request to the attacker&#39;s host carries &#34;Authorization: Bearer…</p> <p><strong>Affected:</strong> RubyGems: mechanize</p> <p>## Summary</p> <p>`mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credentials set through `Mechanize#request_headers=` leaked even when they were `Authorization`.</p> <p>## Details</p> <p>Two defects, both in `lib/mechanize/http/agent.rb`.</p> <p>**1. `Mechanize#request_headers=` bypassed the redirect strip entirely.** `#request_add_headers` copied `@request_headers` onto every request unconditionally, with no host check, including the request issued after a redirect. The strip in `#response_redirect` mutated only the per-request headers hash and never touched agent state. Because `request_headers=` is the documented way to set a default credential for every request, the header the code explicitly protected — `Authorization` — was the one most likely to leak.</p> <p>**2. The strip list omitted `Proxy-Authorization` and `Cookie2`.** Only `CREDENTIAL_HEADERS = [&#39;Authorization&#39;]` and `COOKIE_HEADERS = [&#39;Cookie&#39;]` were removed from the per-request headers hash on a cross-host redirect.</p> <p>Cookies held in `Mechanize#cookie_jar` and credentials held in `Mechanize::HTTP::AuthStore` are **not** affected. Both are looked up per-URI, so they never follow a redirect to a foreign host. The exposure was limited to headers the caller set by hand.</p> <p>## PoC</p> <p>```ruby agent = Mechanize.new agent.request_headers = { &#39;Authorization&#39; =&gt; &#39;Bearer secret&#39; } agent.get(&#39;https://example.test/redirects-to-attacker&#39;) # the request to the attacker&#39;s host carries &#34;Authorization: Bearer…</p> https://vulnerability.circl.lu/vuln/ghsa-2mwr-xjcg-37j7