CVE-2023-24622 safeurl-python contains Server-Side Request Forgery
An attacker can bypass URL validation checks in safeurl-python to perform Server-Side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-24622?
CVE-2023-24622 is a medium-severity server-side request forgery vulnerability in n/a, published on 30 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
Weakness: CWE-918
Which versions are affected by CVE-2023-24622?
3 open source packages ship an affected version, including safeurl-python. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
safeurl-python PyPI | All versions | 1.2 |
safeurl-python PyPI | All versions | 1.2 |
safeurl-python PyPI | All versions | 1.2 |
Products include Includesecurity Safeurl-Python.
How do I fix CVE-2023-24622?
Upgrade safeurl-python to 1.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-24622 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24622 exists.
Sources
Also known as GHSA-jgh8-vchw-q3g7, PYSEC-2023-298.