Listen to this Post
NLTK before 3.10.3 contains a server-side request forgery vulnerability in `nltk.pathsec.urlopen` (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. The `pathsec.urlopen` function validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers (_SafeHTTPHandler and _SafeHTTPSHandler) so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content.
The root cause is that the hardened direct connection path pins the validated numeric destination IP before opening the socket. However, once proxy inheritance is enabled, the proxied branch copies `ProxyHandler` instances from the global opener, marks the request as proxied, and skips the pinned handlers. This means the validated hostname no longer matches the actual egress destination. I confirmed that a validated public URL can be fetched from a loopback-only internal service through the proxy path via pathsec.urlopen(), nltk.data.load(), Downloader.index(), and Downloader.download().
The vulnerability exists in current source v3.10.0-rc2; published 3.9.4 was a negative control and did not reproduce. It is not yet patched in affected versions. The fix preserves destination validation for the actual proxy egress target or fails closed when the request would otherwise downgrade into an unpinned proxied path. Under `ENFORCE` a proxied fetch is refused rather than performed unvalidated. Operators who trust their proxy can opt back in with `NLTK_ALLOW_PROXIED_URLOPEN=1` or nltk.pathsec.ALLOW_PROXIED_FETCH=True; under `ENFORCE=False` the refusal degrades to a warning. This closes the whole class (environment proxies and explicit `ProxyHandler` alike), because NLTK declines any fetch whose egress it cannot validate.
DailyCVE Form:
Platform: NLTK (Python)
Version: <3.10.3
Vulnerability: SSRF Bypass
Severity: High
date: 2026-08-25
Prediction: 2026-09-10
What Undercode Say:
Analytics showing the vulnerability in action:
Setup: Loopback HTTP server serving internal secret
python -m http.server 8080 --bind 127.0.0.1
Configure proxy to forward public URL to internal service
export http_proxy=http://127.0.0.1:8080
export https_proxy=http://127.0.0.1:8080
Vulnerable call - returns internal secret via proxy
python -c "import nltk.pathsec; print(nltk.pathsec.urlopen('http://public.example.com').read())"
Exploit: (Educational Purposes!)
Minimal reproducible excerpt
{'urlopen': 'PROXY_TEXT_SECRET', 'data_load': 'PROXY_TEXT_SECRET', 'downloaded_file': 'INTERNAL_ZIP_SECRET'}
Preconditions:
- Runtime has HTTP proxy configured
- Caller relies on pathsec to keep network fetches SSRF-safe
Steps:
- Start loopback-only HTTP server serving secret text, valid downloader index, and ZIP payload
- Configure proxy that forwards validated public URL to internal loopback service
- Call `pathsec.urlopen()` or `nltk.data.load()` on public URL and observe internal response returned
- Instantiate
Downloader(server_index_url=...), call `index()` anddownload(), observe internal-only content parsed and installed
Protection:
Upgrade to NLTK 3.10.3 or later. If upgrade is not immediately possible, set `NLTK_ALLOW_PROXIED_URLOPEN=0` or `nltk.pathsec.ALLOW_PROXIED_FETCH=False` to block proxied fetches. Alternatively, avoid using NLTK’s network-loading helpers in environments with HTTP proxies configured. Add regression tests across pathsec.urlopen, nltk.data.load, and downloader fetches with a configured proxy.
Impact:
Consumers that trust `pathsec` as an SSRF barrier in proxied environments can be made to read internal-only HTTP resources, load forged downloader indexes, and install attacker-chosen package content fetched from the proxy’s network view. The vulnerability allows full-response SSRF (non-blind), potentially exposing cloud metadata endpoints and other internal infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
