CVE-2025-0938
`urllib.parse` allows invalid domain names with square brackets, causing parsing issues.
- CVSS 6.3
- CWE-20
- Input Validation and Sanitization
- Remote
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
- CWE
- CWE-20
- CVSS base score
- 6.3
- Published
- 2025-01-31
- OWASP
- A03 Injection
- Orthogonal defect classification
- Algorithm
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Information Disclosure
- Affected component
- Python
- Fixed by upgrading
- Yes
Solution
Upgrade to Python 3.10.7+, 3.9.14+, 3.8.14+, or 3.7.17+.
Vulnerable code sample
from urllib.parse import urlparse, urlsplit
urls = [
"http://[example].com",
"http://test.[example].com",
"http://[evil].example.com",
"http://example[.]com",
"http://example.[com]",
"http://[example.com]",
]
print("Testing with urlparse:")
for url in urls:
parsed_url = urlparse(url)
print(f"URL: {url}, Result: {parsed_url}")
print("\nTesting with urlsplit:")
for url in urls:
parsed_url = urlsplit(url)
print(f"URL: {url}, Result: {parsed_url}")Patched code sample
import urllib.parse
def is_valid_domain_char(char):
return char.isalnum() or char in "-."
def validate_domain(hostname):
if "[" in hostname or "]" in hostname:
return False
for char in hostname:
if not is_valid_domain_char(char):
return False
return True
def modified_urlparse(url):
parsed_url = urllib.parse.urlparse(url)
if parsed_url.hostname and not validate_domain(parsed_url.hostname):
return urllib.parse.ParseResult(scheme='', netloc='', path='', params='', query='', fragment='')
return parsed_url
def modified_urlsplit(url):
parsed_url = urllib.parse.urlsplit(url)
if parsed_url.hostname and not validate_domain(parsed_url.hostname):
return urllib.parse.SplitResult(scheme='', netloc='', path='', query='', fragment='')
return parsed_url
if __name__ == '__main__':
urls = [
"http://[example].com",
"http://test.[example].com",
"http://[evil].example.com",
"http://example[.]com",
"http://example.[com]",
"http://[example.com]",
]
print("Testing with modified_urlparse:")
for url in urls:
parsed_url = modified_urlparse(url)
print(f"URL: {url}, Result: {parsed_url}")
print("\nTesting with modified_urlsplit:")
for url in urls:
parsed_url = modified_urlsplit(url)
print(f"URL: {url}, Result: {parsed_url}")Payload
`http://[example.com]/path`Cite this entry
@misc{vaitp:cve20250938,
title = {{`urllib.parse` allows invalid domain names with square brackets, causing parsing issues.
}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2025},
note = {VAITP Python Vulnerability Dataset, entry CVE-2025-0938},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-0938/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::