CVE-2024-11168: urllib.parse SSRF Vulnerability

CVE-2024-11168 Overview

CVE-2024-11168 is a Server-Side Request Forgery (SSRF) vulnerability in Python's urllib.parse module. The urlsplit() and urlparse() functions improperly validated bracketed hosts ([]), allowing hosts that weren't IPv6 or IPvFuture addresses. This behavior was not conformant to RFC 3986 and potentially enabled SSRF attacks when a URL is processed by more than one URL parser.

Critical Impact

Applications using Python's urllib.parse functions to validate or parse URLs may be vulnerable to SSRF attacks, allowing attackers to bypass security controls and access internal resources or services that should not be directly accessible.

Affected Products

• Python Standard Library (urllib.parse module)
• Applications using urllib.parse.urlsplit() or urllib.parse.urlparse() for URL validation
• Systems relying on Python URL parsing for security-critical decisions

Discovery Timeline

• 2024-11-12 - CVE-2024-11168 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-11168

Vulnerability Analysis

This vulnerability exists in Python's urllib.parse module, specifically in the urlsplit() and urlparse() functions. According to RFC 3986, bracketed notation ([]) in the host component of a URL should only be used for IPv6 addresses or IPvFuture literals. However, the affected Python functions failed to properly enforce this requirement, accepting arbitrary content within brackets as valid host components.

The improper validation creates a dangerous scenario in multi-parser environments. When a URL passes through Python's urllib.parse for validation and then gets processed by another URL parser with different parsing behavior, an attacker can craft malicious URLs that bypass security checks. The first parser may accept the URL as pointing to an allowed destination, while the second parser interprets it differently, redirecting requests to internal or malicious endpoints.

This type of parser differential vulnerability is particularly dangerous in web applications that implement URL whitelisting or blocklisting, proxy services, and any system that validates URLs before making outbound requests.

Root Cause

The root cause is insufficient input validation in the host parsing logic of urllib.parse.urlsplit() and urllib.parse.urlparse(). The functions accepted bracketed hosts containing arbitrary content rather than strictly validating that bracketed content conforms to IPv6 address or IPvFuture literal formats as specified in RFC 3986 Section 3.2.2.

Attack Vector

The attack vector is network-based and exploits the parsing inconsistency between Python's urllib.parse and other URL parsers. An attacker can craft a URL with a malformed bracketed host component that:

1. Passes validation by Python's urllib.parse as an ostensibly safe URL
2. Gets reinterpreted by a downstream URL parser or HTTP client to target a different destination
3. Results in requests being sent to internal services, metadata endpoints, or other restricted resources

The vulnerability enables SSRF attacks where applications that use urllib.parse to validate URLs before making requests can be tricked into accessing unintended destinations. This is particularly impactful in cloud environments where internal metadata services (such as 169.254.169.254) may be accessible.

Detection Methods for CVE-2024-11168

Indicators of Compromise

• Unusual outbound requests to internal IP ranges or metadata endpoints from application servers
• Web application logs showing URLs with unusual bracketed host components (e.g., http://[malicious]@target/)
• Network traffic to internal services originating from components that should only make external requests
• Evidence of data exfiltration from cloud metadata services or internal APIs

Detection Strategies

• Audit Python applications for usage of urllib.parse.urlsplit() or urllib.parse.urlparse() in URL validation workflows
• Implement network monitoring to detect outbound requests to internal IP ranges from web-facing applications
• Review application logs for URLs containing unusual bracketed host patterns
• Deploy web application firewall (WAF) rules to detect and block SSRF attack patterns

Monitoring Recommendations

• Monitor outbound connections from application servers for requests to RFC 1918 private address ranges and cloud metadata endpoints
• Implement logging for all URL parsing operations in security-sensitive contexts
• Set up alerts for Python applications making requests to destinations that differ from initially validated URLs
• Track egress traffic patterns for anomalies indicating potential SSRF exploitation

How to Mitigate CVE-2024-11168

Immediate Actions Required

• Update Python to a patched version that includes the security fix for CVE-2024-11168
• Audit applications for URL parsing workflows that may be vulnerable to SSRF attacks
• Implement additional URL validation beyond urllib.parse to verify host components conform to expected formats
• Configure network-level controls to restrict outbound access from application servers to internal resources

Patch Information

The Python security team has released patches to address this vulnerability. Multiple commits have been applied to the CPython repository to fix the improper URL parsing behavior:

• CPython Commit 29f348e
• CPython Commit 634ded4
• CPython Commit b2171a2
• CPython Commit ddca295

For detailed information, refer to GitHub Issue #103848, GitHub PR #103849, and the Python Security Mailing List Thread. Debian users should consult the Debian LTS Announcement, and NetApp customers can review the NetApp Security Advisory.

Workarounds

• Implement strict RFC 3986 compliant URL validation before passing URLs to urllib.parse functions
• Add application-level checks to verify that parsed hostnames match expected patterns and do not contain arbitrary bracketed content
• Deploy network segmentation to prevent application servers from accessing internal services directly
• Use allowlists for permitted destination hosts rather than relying solely on URL parsing for security

# Example: Restrict outbound access using iptables
# Block access to internal networks from application servers
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP