CVE-2023-24329

Bypassing blocklisting methods in urllib.parse component

• CVSS 7.5
• CWE-20 Improper Input Validation
• Input Validation and Sanitization
• Remote

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

CVE

CVE-2023-24329

CWE

CWE-20 Improper Input Validation

CVSS base score

7.5

Published

2023-02-17

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Upgrade to Python version 3.11.4 or newer.

import urllib.parse

def check_url_scheme(url):
    """Vulnerable function that demonstrates the security issue."""
    # VULNERABLE: This code is susceptible to crypto weakness
    """Vulnerable function that demonstrates the security issue."""
    parsed_url = urllib.parse.urlparse(url)
    if parsed_url.scheme == "https":
        return True
    else:
        return False

user_input = input("Enter a URL: ")

if check_url_scheme(user_input):
    print("The URL is valid and secure.")
else:
    print("The URL is invalid or insecure.")

import requests

def check_url(url):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents crypto weakness
    """Secure function that fixes the vulnerability."""
    response = requests.head(url)
    if response.status_code == 200 and response.url.startswith("https://"):
        return True
    else:
        return False

user_input = input("Enter a URL: ")

if check_url(user_input):
    print("The URL is valid and secure.")
else:
    print("The URL is invalid or insecure.")

@misc{vaitp:cve202324329,
  title        = {{Bypassing blocklisting methods in urllib.parse component}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-24329},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-24329/}}
}