CVE-2024-11168

Improper validation of bracketed hosts in URL parsing functions.

• CVSS 6.3
• CWE-918
• Input Validation and Sanitization
• Remote

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

CVE

CVE-2024-11168

CWE

CWE-918

CVSS base score

6.3

Published

2024-11-12

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Server-Side Request Forgery (SSRF)

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Python 3.10

Fixed by upgrading

Yes

Solution

Upgrade to Python 3.10 or later, where the URL parsing functions have improved validation for bracketed hosts.

from urllib.parse import urlparse, urlsplit

url = "http://[not-an-ipv6]:8080/path"

parsed_url = urlparse(url)
print("Parsed URL:", parsed_url)

if parsed_url.hostname:
    print("Hostname:", parsed_url.hostname)
else:
    print("No valid hostname found.")

from urllib.parse import urlparse
import ipaddress
import re

def is_valid_hostname(hostname):
    if not hostname:
        return False
    if len(hostname) > 255:
        return False
    if hostname[-1] == ".":
        hostname = hostname[:-1]
    allowed = re.compile(r"(?!-)[A-Z\d\-]{1,63}(?<!-)$", re.IGNORECASE)
    return all(allowed.match(x) for x in hostname.split("."))

def is_valid_ipv6(hostname):
    try:
        ipaddress.IPv6Address(hostname)
        return True
    except ValueError:
        return False

url = "http://[not-an-ipv6]:8080/path"
parsed_url = urlparse(url)

hostname = parsed_url.hostname

if hostname:
    if is_valid_hostname(hostname) or is_valid_ipv6(hostname):
        print("Valid hostname:", hostname)
    else:
        print("Invalid hostname.")
else:
    print("No valid hostname found.")

"http://[malicious-host]:8080/path"

@misc{vaitp:cve202411168,
  title        = {{Improper validation of bracketed hosts in URL parsing functions.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-11168},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-11168/}}
}