New Python URL Parsing Flaw Enables Command Injection Attacks

A high-severity security flaw has been disclosed in the Python URL parsing functionality that could be exploited to bypass area or protocol filtering methods executed with a blocklist, in the end ensuing in arbitrary file reads and command execution.

“urlparse has a parsing difficulty when the whole URL begins with blank figures,” the CERT Coordination Middle (CERT/CC) claimed in a Friday advisory. “This trouble has an effect on equally the parsing of hostname and plan, and at some point will cause any blocklisting methods to are unsuccessful.”

The flaw has been assigned the identifier CVE-2023-24329 and carries a CVSS score of 7.5. Security researcher Yebo Cao has been credited with getting and reporting the issue in August 2022. It has been dealt with in the following variations –

• >= 3.12
• 3.11.x >= 3.11.4
• 3.10.x >= 3.10.12
• 3.9.x >= 3.9.17
• 3.8.x >= 3.8.17, and
• 3.7.x >= 3.7.17

urllib.parse is a greatly made use of parsing functionality that can make it feasible to break down URLs to its constituents, or alternatively, combine the factors to a URL string.

CVE-2023-24329 arises as a consequence of a deficiency of enter validation, thereby foremost to a state of affairs in which it can be attainable to get all over blocklisting approaches by giving a URL that begins with blank people (e.g., ” https://youtube[.]com”).

“While blocklist is thought of an inferior decision, there are quite a few situations where blocklist is continue to needed,” Cao claimed. “This vulnerability would support an attacker to bypass the protections established by the developer for plan and host. This vulnerability can be predicted to assist SSRF and RCE in a huge variety of scenarios.”

Discovered this posting appealing? Stick to us on Twitter  and LinkedIn to browse extra special information we put up.

Some parts of this article are sourced from:
thehackernews.com