Listen to this Post
How the Mentioned CVE Works:
The vulnerability (GHSA-hm5p-x4rq-38w4) is a logic flaw in the HTTP client library `httparty` for Ruby. When a class using `httparty` has a `base_uri` configured, it is expected to prepend this base to all relative path requests. However, if the argument passed to a request method (like .get) is an absolute URL string, the library’s logic incorrectly prioritizes this user-provided URL and completely ignores the configured base_uri. This allows an attacker who controls the path parameter to redirect the HTTP request—including all headers, cookies, and authentication tokens like `X-API-KEY` set in the class—to an arbitrary host of their choosing. The request is made from the application server, enabling access to internal network services that are otherwise unreachable from the internet, fulfilling the conditions for a Server-Side Request Forgery (SSRF). The impact is compounded because the library’s default behavior seamlessly sends sensitive credentials to the attacker’s server without validation.
dailycve form:
Platform: httparty Ruby gem
Version: <=0.22.0
Vulnerability : SSRF & Credential Leak
Severity: High
date: 2025-12-24
Prediction: 2026-01-31
What Undercode Say:
Analytics:
Setting up test servers to demonstrate the vulnerability mkdir /tmp/server1 /tmp/server2 echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html python -m http.server -d /tmp/server1 10001 & python -m http.server -d /tmp/server2 10002 &
main.rb - Proof-of-Concept script
require 'httparty'
class Client
include HTTParty
base_uri 'http://localhost:10001' Intended base
end
This request will incorrectly go to localhost:10002
data = Client.get('http://localhost:10002').body
puts data Prints "this is server2"
How Exploit:
Credential Theft: Supply an absolute URL to an attacker-controlled server in a vulnerable parameter. The `httparty` client will send the request with its configured API keys or headers to that server.
Internal Network SSRF: Use the vulnerable endpoint to scan and interact with internal services by providing absolute URLs with internal IP addresses (e.g., `http://192.168.1.1/admin`).
Protocol Bypass: If the vulnerable parameter is inserted into a URL path, an attacker might use URL formatting like `https://[email protected]` or other SSRF bypass techniques to redirect the request.
Protection from this CVE:
Input Validation: Strictly validate user input used in HTTP requests. Reject any input containing a protocol scheme (http://`,https://`).
URL Parsing & Allow-Listing: Parse user input and allow-list only permitted domains or IP addresses before making a request.
Use Relative Paths: Ensure only relative paths (e.g., /api/v1/users) are passed to the `httparty` client methods.
Network Controls: Implement network segmentation and egress firewalls to restrict the application server’s outbound connections.
Impact:
API Key & Credential Leakage: Sensitive authentication headers are sent to attacker-controlled systems.
Server-Side Request Forgery (SSRF): Enables attacks on internal infrastructure and cloud metadata services.
Broad Attack Surface: Affects any application using `httparty` with a `base_uri` where user input influences the request path.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
