Improper Host Validation in urllib: SSRF Vulnerability in pypy3 and python3 Packages
Summary
DEBIAN-CVE-2024-11168: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts ([]), allowing hosts that weren't IPv6 or IPvFuture. Affects pypy3 versions < 7.3.18+dfsg-1. Fixed in 7.3.18+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pypy3 and python3 packages are implementations of the Python programming language, widely used for various applications ranging from web development to data analysis. These packages provide essential libraries and functionalities, including URL parsing through urllib. The vulnerability in question affects how these packages validate bracketed hosts in URLs, which can lead to security issues if exploited.
Vulnerability Detail
The vulnerability arises from improper validation of bracketed hosts ('[]') in the urllib.parse.urlsplit() and urlparse() functions. This flaw allows hosts that are neither IPv6 nor IPvFuture to be processed incorrectly, potentially leading to Server-Side Request Forgery (SSRF) attacks. Such attacks can occur if a URL is parsed by multiple URL parsers, which may not adhere to the standards set by RFC 3986. This could allow an attacker to manipulate requests sent to internal services, exposing sensitive data or functionalities.
How To Fix
Minimum fixed version
7.3.18+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pypy3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks in your application to ensure that URLs are properly formatted and do not contain invalid bracketed hosts. This can be done by using regular expressions or custom validation functions to sanitize input before processing URLs.
Conclusion
The improper validation of bracketed hosts in the urllib functions poses a significant security risk, particularly for applications using the pypy3 and python3 packages. It is crucial to update to the patched versions to safeguard against potential SSRF attacks. Implementing additional validation checks can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for pypy3 →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive information.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to get real-time alerts.
Exploitation of this vulnerability could lead to unauthorized access to internal services, data leakage, or other malicious activities, depending on the application's architecture.
While updating is the best solution, you can implement additional URL validation checks in your application as a temporary measure to mitigate the risk.
Detailed information about this vulnerability can be found in the Debian CVE database and other security advisory platforms.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypy3.
