Server-side Request Forgery (SSRF) Affecting safeurl-python package, versions [,1.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SAFEURLPYTHON-3251746
- published 27 Jan 2023
- disclosed 27 Jan 2023
- credit Dirox
Introduced: 27 Jan 2023
CVE-2023-24622 Open this link in a new tabHow to fix?
Upgrade safeurl-python to version 1.2 or higher.
Overview
safeurl-python is a library that aids developers in protecting against SSRF
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in some circumstances, due to a permissive regex (re.match("(?i)^%s" % domain, value)) used in domain filtering. This allows a benign domain like victim.com that appears on the allowlist to match the unintended domain victimacomattacker.com. The most common use of the allowlist functionality is for internal resources and therefore the potential for successful SSRF is limited.