CVE-2019-10751 Open Redirect in httpie
An attacker can exploit an open redirect in HTTPie to write arbitrary files to the current directory by redirecting requests to a malicious server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10751?
CVE-2019-10751 is a high-severity vulnerability in HTTPIE, published on 23 Aug 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
Weakness: CWE-601
Which versions are affected by CVE-2019-10751?
3 open source packages ship an affected version, including httpie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
httpie PyPI | All versions | 1.0.3 |
httpie PyPI | All versions | 1.0.3 |
httpie PyPI | All versions | 1.0.3 |
Linux distribution packages (4)
httpie SUSE:Package Hub 15 SP1 | All versions | 1.0.3-bp151.2.3.1 |
httpie SUSE:Package Hub 15 SP1 | All versions | 1.0.3-bp151.2.6.1 |
httpie openSUSE:Leap 15.1 | All versions | 1.0.3-bp151.2.3.1 |
httpie openSUSE:Tumbleweed | All versions | 2.5.0-1.2 |
Products include Httpie Httpie.
How do I fix CVE-2019-10751?
Upgrade httpie to 1.0.3 or later.
Is CVE-2019-10751 being exploited?
There is no known exploitation of CVE-2019-10751 in the wild and no public exploit code.
Other vulnerabilities in HTTPIE
Sources
Also known as DEBIAN-CVE-2019-10751, DLA-1937-1, GHSA-xjjg-vmw6-c2p9, MGASA-2019-0351, PYSEC-2019-23, SNYK-PYTHON-HTTPIE-460107 and 4 more.