CVE-2023-43804: urllib3 Cookie Leak Reproduction & Remediation Lab

The repository includes a fully containerized, three-tier lab environment which is intended for demonstrating, taking advantage of, and verifying the fixes for CVE-2023-43804 (the urllib3 Cookie Leak occurring during cross-origin redirects).

1. Lab Environment & Architecture

The lab is orchestrated using Docker Compose and consists of three isolated services communicating over an internal bridge network:

• victim_client: Python-based container executing the reproduction and exploit script (exploit.py).
• target_app: Flask web application simulating a vulnerable target server that triggers an HTTP 302 cross-origin redirect to an external origin.
• attacker_app: Flask logging server designed to capture incoming HTTP requests and extract leaked headers.

2. Prerequisites & System Requirements

• Docker Desktop installed and running.
• Docker Compose (v2+).
• PowerShell or any standard command-line shell.

3. Installation & Setup Steps

1. Clone the repository and navigate into the project directory:
   root@kitploit:~

   git clone [https://github.com/deepanshu-khurana/cve-2023-43804-lab.git](https://github.com/deepanshu-khurana/cve-2023-43804-lab.git)
   cd cve-2023-43804-lab
   
   
   
   

2. Build and spin up the containerized lab infrastructure:

docker compose up -d --build

4. How to Start and Stop the Lab

• Start Lab Containers:

docker compose up -d

• Stop Lab & Clean Resources:

docker compose down --volumes

5. Vulnerability Overview (CVE-2023-43804)

• Vulnerable Component: urllib3
• Vulnerable Versions: < 1.26.17 or < 2.0.5
• Vulnerability Description: urllib3 failed to strip sensitive authentication headers (such as Cookie) when following HTTP 302 redirects across different origins, allowing untrusted redirection endpoints to intercept sensitive session tokens.

6. How to Exploit the Vulnerability (Phase 1)

1. Ensure the vulnerable version of urllib3 is installed inside the client container:

docker exec -it victim_client pip install urllib3==1.26.16

2. Execute the exploit script:

docker exec -it victim_client python3 -u /lab/exploit.py

3. Expected Vulnerable Result:

• Client output displays "status": "EXFILTRATED" alongside the leaked session token.
• docker logs attacker_app displays the captured sensitive cookie header.

7. How to Run the Detection & Verification Mechanism (Phase 2)

To verify the patch after observing the exploit:

1. Upgrade urllib3 inside the client container to the patched version:

docker exec -it victim_client pip install urllib3==1.26.17

2. Re-run the exploit script:

docker exec -it victim_client python3 -u /lab/exploit.py

3. Expected Patched Result:

• Client output displays "status": "SECURE", "stolen_cookie": "None / Stripped".
• attacker_app logs confirm that the incoming request contains Leaked Cookie Header: None.

8. Remediation

• Library Upgrade: Update dependencies in requirements.txt to enforce safe versions:

urllib3>=1.26.17

• Defense-in-Depth: Explicitly configure header management policies via remove_headers_on_redirect in custom Retry configurations if maintaining legacy runtimes.

9. Troubleshooting Notes

• Container Naming: Ensure you target container names accurately (victim_client, target_app, attacker_app) as assigned by Docker Compose. Use docker ps to verify active container names.
• Port Availability: Ensure ports 5000 and 5001 are not occupied by other local services before launching the Docker stack.

10. Lab Demonstration & Results

Phase 1: Vulnerable State (Cookie Leakage)

When running the lab on vulnerable urllib3==1.26.16, the sensitive authentication cookie is intercepted across cross-origin redirects and successfully logged by the attacker server.

• Client Output & Server Log Capture:
  • Figure 1.1: exploit.py displaying "status": "EXFILTRATED" alongside the leaked session token, verified by attacker_app log output.

Phase 2: Patch Verification (Secure State)

After upgrading urllib3 to the patched version (1.26.17), the library automatically strips the sensitive Cookie header during cross-origin redirects.

• Package Upgrade to Patched Version:

  • Figure 2.1: Upgrading urllib3 inside victim_client via pip install urllib3==1.26.17.

• Secure Client Output & Stripped Logs:

  • Figure 2.2: exploit.py returning "status": "SECURE" with "stolen_cookie": "None / Stripped", confirmed by the server log showing Leaked Cookie Header: None.