T08 · Insecure Dependencies
- Location
SKILL.md:8- Finding
Outdated Requests Dependency May Disclose Proxy Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:8-10
Related Usage:scripts/shodan_api.py:22
Vulnerability Type: Outdated third-party dependency with known proxy credential disclosure behavior
Risk Level: MediumVulnerable Code
yaml dependency: python: - requests==2.28.0The pinned dependency is imported and used for all Shodan API requests:
python import requestsTechnical Analysis
The project explicitly pins
requests==2.28.0, an outdated version affected by CVE-2023-32681. Under certain HTTPS proxy and redirect conditions, vulnerable Requests versions may forward proxy authentication information during a redirected request.The API client uses Requests for every external operation and retains its default redirect behavior:
python if method.upper() == "GET": response = requests.get(url, params=params, timeout=30) elif method.upper() == "POST": response = requests.post(url, params=params, timeout=30)Exploitation is conditional: the runtime must use an authenticated HTTPS proxy, and an attacker must be able to influence or compromise the redirect chain. The audit found no evidence that the project deliberately redirects traffic or transmits credentials to an unrelated destination.
Attack Path
- The Skill is installed with the pinned
requests==2.28.0dependency. - It runs in an environment configured to use an HTTPS proxy with authentication credentials.
- The client sends a Shodan API request through that proxy.
- The request encounters a redirect controlled or influenced by an attacker, such as through compromised network or remote infrastructure.
- The vulnerable redirect handling behavior may forward sensitive proxy authentication information.
- The attacker captures and potentially reuses the disclosed proxy credentials, subject to the credentials' permissions and environmental access controls.
Impac
...[truncated 571 chars]
- The Skill is installed with the pinned
- Remediation
View remediation
Remediation Suggestions
- Replace the
requests==2.28.0pin with a maintained version that includes the fix for CVE-2023-32681. Prefer the latest compatible stable release after compatibility testing. - Regenerate any dependency lock files and verify the resolved dependency graph after upgrading.
- Add automated dependency scanning, such as
pip-audit, OSV-Scanner, or Dependabot, to CI. - Use hashes and a trusted package index when installing Python dependencies to improve supply-chain integrity.
- Review HTTPS proxy configuration and avoid embedding proxy credentials in environment variables or configuration files where possible.
- Rotate potentially exposed proxy credentials if this version has previously run in an authenticated HTTPS proxy environment with untrusted redirect paths.
- Add tests covering redirects through authenticated proxies and, where redirects are not required, consider explicitly disabling them or validating redirect destinations before following them.
- Replace the