CVE-2021-41945: Encode Httpx Input Validation Vulnerability

CVE-2021-41945 Overview

CVE-2021-41945 is an improper input validation vulnerability affecting Encode OSS httpx, a popular Python HTTP client library. Versions prior to 0.23.0 are affected by improper input validation in httpx.URL, httpx.Client, and several functions utilizing httpx.URL.copy_with. This vulnerability allows attackers to manipulate URL handling, potentially leading to unauthorized access to sensitive information or the ability to modify data in transit.

Critical Impact

This improper input validation vulnerability in httpx allows attackers to exploit URL parsing weaknesses, potentially enabling Server-Side Request Forgery (SSRF) attacks or bypassing security controls in applications that rely on httpx for HTTP communications.

Affected Products

• Encode httpx versions prior to 0.23.0
• Python applications using vulnerable httpx versions
• Any system or service relying on affected httpx library for HTTP requests

Discovery Timeline

• 2022-04-28 - CVE CVE-2021-41945 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-41945

Vulnerability Analysis

The vulnerability stems from insufficient input validation within the httpx URL parsing and handling components. The affected functions (httpx.URL, httpx.Client, and httpx.URL.copy_with) fail to properly validate and sanitize URL inputs, creating potential security weaknesses.

When httpx processes URLs, the improper validation allows specially crafted URL strings to bypass expected security checks. This can lead to unexpected behavior in how the library resolves and connects to target hosts, potentially allowing attackers to redirect requests to unintended destinations or access internal resources.

The network-accessible nature of this vulnerability means that applications exposing httpx-based functionality to untrusted input are at significant risk. Exploitation requires no authentication or user interaction, making it particularly dangerous in web applications and APIs.

Root Cause

The root cause of CVE-2021-41945 is classified as CWE-20 (Improper Input Validation). The httpx library prior to version 0.23.0 did not adequately validate URL components when parsing user-supplied input or when using the copy_with method to modify URL objects. This allows attackers to inject malicious values that bypass expected URL structure validation.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this vulnerability by providing maliciously crafted URLs to applications using vulnerable versions of httpx. The attack does not require any privileges or user interaction.

Exploitation typically involves:

1. Identifying an application using httpx for HTTP requests
2. Crafting a malicious URL that exploits the improper validation
3. Supplying this URL to the application through any input vector that gets processed by httpx
4. The malformed URL bypasses validation checks, potentially redirecting requests or accessing unintended resources

For detailed technical analysis and proof-of-concept information, refer to the GitHub Gist Code Snippet and the GitHub HTTPX Issue.

Detection Methods for CVE-2021-41945

Indicators of Compromise

• Unexpected outbound HTTP connections to internal IP addresses or localhost from applications using httpx
• Anomalous URL patterns in application logs showing malformed or suspicious URL structures
• Evidence of SSRF-like behavior where internal resources are accessed through external-facing applications
• Unusual error messages related to URL parsing or connection failures in httpx

Detection Strategies

• Implement dependency scanning to identify httpx versions prior to 0.23.0 in your Python environments
• Monitor application logs for suspicious URL patterns that may indicate exploitation attempts
• Deploy web application firewalls (WAF) with rules to detect malformed URL injection attempts
• Use runtime application self-protection (RASP) to detect and block URL manipulation attacks

Monitoring Recommendations

• Enable verbose logging for httpx operations in production environments to capture URL handling behavior
• Set up alerts for any httpx-related errors or exceptions that may indicate exploitation attempts
• Monitor network traffic for unexpected connections originating from applications using httpx
• Regularly audit Python dependencies using tools like pip-audit or Snyk to detect vulnerable packages

How to Mitigate CVE-2021-41945

Immediate Actions Required

• Upgrade httpx to version 0.23.0 or later immediately to address this vulnerability
• Audit all Python applications and services using httpx to identify vulnerable installations
• Review application code for any custom URL handling that may be affected by this vulnerability
• Implement input validation at the application level as a defense-in-depth measure

Patch Information

Encode has released version 0.23.0 of httpx that addresses this improper input validation vulnerability. Organizations should upgrade to this version or later as soon as possible.

The fix can be applied by updating the httpx package using pip:

pip install --upgrade httpx>=0.23.0

For additional information about the release, see the GitHub HTTPX Release 0.23.0. Community discussion regarding this issue is available at the GitHub HTTPX Discussion.

Workarounds

• Implement strict input validation for all URLs before passing them to httpx functions
• Use allowlists for permitted hosts and URL schemes to restrict where httpx can make requests
• Deploy network-level controls to prevent SSRF attacks by blocking internal network access from vulnerable applications
• Consider using a web application firewall to filter malicious URL patterns at the perimeter

# Configuration example - Upgrade httpx using pip
pip install httpx==0.23.0

# Verify installed version
pip show httpx | grep Version

# For requirements.txt, ensure minimum version
# httpx>=0.23.0