Python CPython up to 3.11.3/3.12.0b0 URL Parser urllib.parse.urlsplit urllib.parse.urlsplit/urlparse server-side request forgery

Summaryinfo

A vulnerability labeled as critical has been found in Python CPython up to 3.11.3/3.12.0b0. This affects the function urllib.parse.urlsplit/urlparse in the library urllib.parse.urlsplit of the component URL Parser. Executing a manipulation can lead to server-side request forgery. This vulnerability appears as CVE-2024-11168. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Python CPython up to 3.11.3/3.12.0b0. It has been declared as problematic. This vulnerability affects the function urllib.parse.urlsplit/urlparse in the library urllib.parse.urlsplit of the component URL Parser. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect integrity. CVE summarizes:

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-11168 since 11/12/2024. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 211470 (Python Improper Validation SSRF (CVE-2024-11168)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.11.4 or 3.12.0b1 eliminates this vulnerability. Applying the patch 29f348e232e82938ba2165843c448c2b291504c5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (211470) and CERT Bund (WID-SEC-2024-3463). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• NetApp ActiveIQ Unified Manager
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• Open Source Python
• Dell Avamar
• IBM QRadar SIEM
• Dell NetWorker

Productinfo

Type

• Programming Language Software

Vendor

• Python

Name

• CPython

Version

• 3.11.0
• 3.11.1
• 3.11.2
• 3.11.3
• 3.12.0b0

License

• open-source

Website

• Product: https://github.com/python/cpython/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion