Open Redirect Vulnerability in HTTPie Package - CVE-2019-10751
Summary
CVE-2019-10751: All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a r... Affects httpie across 2 version ranges.
< 1.0.3-1
< 747be30d2efda1b4287a84f1f27f4328621b222c
Fixed in 1.0.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTTPie is a command-line HTTP client designed for making API requests easier and more user-friendly. It provides a simple interface for sending HTTP requests and receiving responses, making it a popular choice among developers. However, all versions prior to 1.0.3 are vulnerable to an Open Redirect issue, which can be exploited by attackers.
Vulnerability Detail
The vulnerability identified as CVE-2019-10751 allows an attacker to redirect a request from HTTP to a malicious URL controlled by the attacker. This can lead to arbitrary file writing in the current directory, posing significant security risks. The flaw exists in the way HTTPie handles URL redirection, allowing crafted URLs to bypass security measures and execute unauthorized actions.
How To Fix
Minimum fixed version
1.0.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade httpieTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider using alternative HTTP clients that do not have this vulnerability or implement strict URL validation to prevent redirection to untrusted domains.
Conclusion
CVE-2019-10751 is a significant vulnerability in the HTTPie package that can lead to serious security risks if not addressed. Users are strongly advised to upgrade to version 1.0.3 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for httpie →
FAQ
CVE-2019-10751 is a vulnerability in the HTTPie package that allows attackers to exploit an Open Redirect issue, potentially leading to arbitrary file writing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized file creation and potential data breaches, making it critical to address.
Yes, you can implement strict URL validation to prevent redirection to untrusted domains as a temporary measure.
The CVSS score for CVE-2019-10751 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for httpie.
