CVE-2025-68696: Jnunemaker Httparty SSRF Vulnerability

CVE-2025-68696 Overview

CVE-2025-68696 is a Server-Side Request Forgery (SSRF) vulnerability affecting the httparty Ruby gem, a widely used HTTP client library for consuming REST APIs. The flaw is present in versions 0.23.2 and prior. An attacker who controls request parameters can coerce applications using httparty into issuing arbitrary requests to internal infrastructure or unintended external endpoints. The maintainers patched the issue in commit 0529bcd.

Critical Impact

Exploitation can leak API keys and credentials, and allow unauthenticated attackers to pivot HTTP requests to internal services that are otherwise unreachable from the public network.

Affected Products

• jnunemaker/httparty versions 0.23.2 and prior
• Ruby applications and gems that depend on vulnerable httparty releases
• Downstream services that pass user-controlled URLs or parameters into HTTParty request methods

Discovery Timeline

• 2025-12-23 - CVE-2025-68696 published to the National Vulnerability Database (NVD)
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-68696

Vulnerability Analysis

The weakness is classified as [CWE-918] Server-Side Request Forgery. httparty accepts URLs and follows redirects when issuing HTTP calls. Versions 0.23.2 and earlier do not adequately constrain the destination of outbound requests when handling certain inputs. An attacker who supplies a malicious URL or triggers a redirect chain can cause the application to send requests to hosts the attacker chooses.

This behavior becomes a security problem when httparty runs inside server-side workflows that proxy URLs supplied by clients, fetch remote resources for previews, or perform webhook callbacks. Sensitive headers, including bearer tokens and API keys configured on the HTTParty client, can be transmitted to attacker-controlled destinations. The same primitive enables probing of cloud metadata endpoints, internal admin interfaces, and other resources reachable from the application host.

Root Cause

The root cause is insufficient validation of request destinations within the HTTP request pipeline. The library does not enforce an allow-list of hosts or schemes and does not strip authentication material when redirects cross trust boundaries. The fix landed in commit 0529bcd and tightens how the library resolves and forwards requests.

Attack Vector

The vulnerability is exploitable over the network with no authentication and no user interaction. A typical attack path involves submitting a URL pointing at an internal address such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:8080/admin, or supplying an external URL that returns a 30x redirect to such an address. The httparty client follows the redirect and returns the internal response, or leaks request headers to the attacker's server. See the GitHub Security Advisory GHSA-hm5p-x4rq-38w4 for additional technical context.

Detection Methods for CVE-2025-68696

Indicators of Compromise

• Outbound HTTP requests from application hosts to RFC1918 ranges, loopback addresses, or cloud metadata IPs such as 169.254.169.254
• Application logs showing HTTParty requests to URLs derived from user input, followed by responses containing internal hostnames or instance metadata fields
• Unexpected redirect chains where httparty follows a public URL to an internal address

Detection Strategies

• Inventory Ruby applications and identify dependencies on httparty at versions <= 0.23.2 using bundle list or software composition analysis tooling
• Inspect application code for calls such as HTTParty.get(params[:url]) where request destinations originate from untrusted input
• Correlate egress proxy logs with application identity to flag requests targeting private IP space

Monitoring Recommendations

• Alert on any outbound traffic from web tiers to link-local (169.254.0.0/16) or loopback destinations
• Capture and review redirect responses (Location headers) returned to backend HTTP clients
• Monitor for API key or token strings appearing in egress traffic to untrusted domains

How to Mitigate CVE-2025-68696

Immediate Actions Required

• Upgrade httparty to the version containing commit 0529bcd or later across all Ruby applications and CI pipelines
• Audit every call site that passes user-controlled URLs to HTTParty and apply strict allow-list validation
• Rotate API keys and tokens that may have been transmitted through vulnerable clients in shared or multi-tenant environments

Patch Information

The maintainers fixed the SSRF in commit 0529bcd. Update Gemfile constraints to require a patched release, run bundle update httparty, and redeploy. Confirm transitive dependencies are not pinning a vulnerable version by inspecting Gemfile.lock.

Workarounds

• Enforce egress filtering at the network layer to block application servers from reaching internal IP ranges and cloud metadata endpoints
• Validate destination URLs in application code by resolving the host and rejecting private, loopback, and link-local addresses before invoking HTTParty
• Disable automatic redirect following by passing follow_redirects: false and validate each hop explicitly when redirects are required

# Update httparty in a Bundler-managed Ruby project
bundle update httparty
bundle list | grep httparty

# Verify the installed version is patched
ruby -e "require 'httparty'; puts HTTParty::VERSION"