CVE-2022-21712
📋 TL;DR
This vulnerability in the Twisted Python networking engine exposes sensitive authentication data (cookies and authorization headers) when following cross-origin redirects. Attackers can steal credentials and session tokens by tricking applications into making requests to malicious sites. Any Python application using Twisted's RedirectAgent or BrowserLikeRedirectAgent for HTTP requests is affected.
💻 Affected Systems
- twisted
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Twisted by Twisted
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, and unauthorized access to protected resources by stealing authentication tokens and credentials.
Likely Case
Session hijacking and unauthorized access to user accounts or API endpoints that rely on cookies or authorization headers.
If Mitigated
Limited impact with proper network segmentation and monitoring, but still exposes authentication data to potential interception.
🎯 Exploit Status
Exploitation requires the attacker to control a redirect endpoint, but the vulnerability itself is straightforward to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: twisted 22.1.0 and later
Vendor Advisory: https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
Restart Required: Yes
Instructions:
1. Upgrade twisted package: pip install --upgrade twisted>=22.1.0
2. Restart all affected Python applications
3. Verify no downgrades occur in dependency resolution
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement network-level controls to prevent outbound HTTP requests to untrusted domains
- Monitor for unusual authentication patterns and implement strict session management controls
🔍 How to Verify
Check if Vulnerable:
Check twisted version: pip show twisted | grep VersionCheck Version:
python -c "import twisted; print(twisted.__version__)"Verify Fix Applied:
Confirm twisted version is 22.1.0 or higher: pip list | grep twisted📡 Detection & Monitoring
Log Indicators:
- Unusual cross-origin redirect patterns in HTTP client logs
- Authentication failures following redirects to unexpected domains
Network Indicators:
- HTTP requests with authentication headers being sent to multiple domains in redirect chains
- Unexpected outbound connections following redirects
SIEM Query:
source="*twisted*" AND ("RedirectAgent" OR "BrowserLikeRedirectAgent") AND status="3xx"🔗 References
- https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2
- https://github.com/twisted/twisted/releases/tag/twisted-22.1.0
- https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
- https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2
- https://github.com/twisted/twisted/releases/tag/twisted-22.1.0
- https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
- https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/
- https://security.gentoo.org/glsa/202301-02
