Exposure of Sensitive Information to an Unauthorized Actor in httpie
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| httpie | httpie | before 3.1.0 | 3.1.0 | Patch available | CNA |
| — | httpie (PyPI) | before 3.1.0 | 3.1.0 | Patch available | GHSA-9w4w-cpc8-h2fq |
- httpie Vendorhttpie Affected before 3.1.0 Fixed in 3.1.0 Patch available CNA
- httpie (PyPI) Vendor— Affected before 3.1.0 Fixed in 3.1.0 Patch available GHSA-9w4w-cpc8-h2fq
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:httpie:httpie:*:*:*:*:*:*:*:* | before 3.1.0 | Vulnerable | httpie |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
- cpe:2.3:a:httpie:httpie:*:*:*:*:*:*:*:* Versions before 3.1.0 Vulnerable ·httpie
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA httpie (httpie) Fixed in 3.1.0
- Fix · GHSA-9w4w-cpc8-h2fq httpie (PyPI) Fixed in 3.1.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24737
- 2026-10-03 Alias added: GHSA-9w4w-cpc8-h2fq
References
Advisory 5
Other 5
- https://github.com/httpie/httpie
- https://github.com/pypa/advisory-database/tree/main/vulns/httpie/PYSEC-2022-34.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4QZD2AZOL7XLNZVAV6GDNXYU6MFRU5RS
- https://lists.fedoraproject.org/archives/list/[email protected]/message/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY
More Httpie vulnerabilities
- TI-2019-08016 Open redirect in HTTPIE CVSS 3.0HIGH 8.8
- TI-2023-26015 Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on… CVSS 3.1HIGH 7.4
- TI-2022-00354 Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-24737 · CVE Program
- CVE-2022-24737 · NVD
- FIRST EPSS
- GHSA-9w4w-cpc8-h2fq · GitHub Advisory Database · CC BY 4.0
- CVE-2022-24737 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences