PlaywrightCapture Class-Level Variable Vulnerability Leading to State Sharing and Data Disclosure

A vulnerability in PlaywrightCapture allows for the unintentional sharing of state between Capture objects within the same Python process. This issue arises because capture-specific configuration and runtime data are stored as mutable class-level variables instead of instance-level variables. As a result, multiple Capture objects can inadvertently share sensitive information such as HTTP headers, cookies, browser storage, HTTP credentials, proxy settings, user-agent information, geolocation data, and captured request details. In environments with multiple users or concurrent operations, this could lead to the unauthorized disclosure of authentication cookies, credentials, or other personal data, and could allow requests to be made using another user's authentication context or proxy configuration, potentially causing unauthorized access to remote resources or disrupting other capture processes.

Impact

The vulnerability could result in the unauthorized sharing and disclosure of sensitive data between users, including authentication cookies, credentials, and browser storage. It could also allow for the unauthorized use of one user's authentication context or proxy settings in actions performed by another user.

Remediation

The vulnerability has been addressed by modifying PlaywrightCapture to store all capture-specific settings and request data as instance variables in the Capture constructor, ensuring that each capture operation remains isolated. Users should update to the latest version of PlaywrightCapture to apply this fix.