Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Python Requests

CVE-2023-32681

githubexploit · 2023-07-22

Description

Python Requests CVE-2023-32681 POC with Vulnerable Version <= 2.30.

Affected Python Requests versions

Python Requests< 2.31.0

All known vulnerabilities by product

Alt Linux Almalinux Astra Linux Centos Debian Linuxmint Red Hat Red Os

CVSS 6.1 for CVE-2023-32681

6.1

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:HIGH

Privileges Required:NONE

User Interaction:REQUIRED

Scope:CHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

Working code

100%confidence this exploit runs

Based on 7 file(s) in the source

EPSS Score

3.0%higher than 85.6% of all CVEs

Updated 2026-07-10

Exploit Details

Modified:2024-09-24 15:29

Last Seen:2025-08-31 21:40

Reporter:hardikmodha

Written in:Go

Last commit:2023-07-22

Repository:Archived

Exploit Code

README23 lines

## https://sploitus.com/exploit?id=1ACA74FA-745C-59A2-BDF4-93C4FB87527F
# POC for CVE-2023-32681

This is a Python 3 implementation of CVE-2023-32681, affecting clients using the [requests](https://github.com/psf/requests) version = 2.31.0 or do `pip3 install -r script/requirements_request_2_31_0.txt`
9. Again execute the POC script by running `python3 script/poc.py` and observe the output. You can see that "Proxy-Authorization" header is now not present in the server response.
Same can also be verified in the server logs. 


## Screenshots

### Proxy server




### requests==2.30.0






### requests==2.31.0

Exploit Code

Share

Share on social media: