CVE-2025-68696: Jnunemaker Httparty SSRF Vulnerability

CVE-2025-68696 Overview

CVE-2025-68696 is a Server-Side Request Forgery (SSRF) vulnerability affecting HTTParty, a popular Ruby gem used for making HTTP requests and consuming RESTful APIs. In versions 0.23.2 and prior, the library fails to properly validate absolute URLs, allowing attackers to bypass the configured base_uri and issue requests to arbitrary destinations, including internal servers and external services.

Critical Impact

This vulnerability enables attackers to leak API keys and credentials, and allows malicious actors to issue unauthorized requests to internal servers, potentially compromising backend infrastructure and sensitive data.

Affected Products

• jnunemaker httparty versions 0.23.2 and prior
• Applications using HTTParty with user-controlled URL inputs
• Ruby applications relying on HTTParty for API integrations

Discovery Timeline

• December 23, 2025 - CVE CVE-2025-68696 published to NVD
• January 7, 2026 - Last updated in NVD database

Technical Details for CVE-2025-68696

Vulnerability Analysis

This SSRF vulnerability (CWE-918) exists in HTTParty's request handling logic where absolute URLs provided by users can bypass the intended base_uri configuration. When an application configures HTTParty with a specific base_uri to restrict outbound requests to a particular domain, an attacker can supply a fully-qualified absolute URL that overrides this restriction entirely.

The vulnerability is particularly dangerous in scenarios where HTTParty is used in server-side applications that accept URL parameters from users. Without proper validation, an attacker could craft requests that target internal infrastructure (such as cloud metadata services at 169.254.169.254), exfiltrate API keys or tokens present in the request context, or pivot to attack other internal services.

Root Cause

The root cause lies in the lack of URI safety validation when processing request paths. HTTParty would accept absolute URLs that completely bypass the configured base_uri, failing to verify that the destination host matches the expected target. The library did not raise an exception when an attacker-supplied absolute URI differed from the configured base URI.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an application endpoint that uses HTTParty to make requests based on user input
2. Supplying an absolute URL pointing to an internal resource or malicious external server
3. HTTParty processes the request, bypassing the intended base_uri restriction
4. The attacker receives responses from internal services or captures credentials included in the request

The patch introduces a new UnsafeURIError exception class and validation logic to detect when an absolute URI doesn't match the configured base_uri:

  # Exception that is raised when common network errors occur.
  class NetworkError < Foul; end

+  # Exception that is raised when an absolute URI is used that doesn't match
+  # the configured base_uri, which could indicate an SSRF attempt.
+  class UnsafeURIError < Foul; end
end

Source: GitHub Commit

The fix adds URI safety validation in the request processing flow:

        new_uri = path.clone
      end

+      validate_uri_safety!(new_uri) unless redirect

      # avoid double query string on redirects [#12]
      unless redirect
        new_uri.query = query_string(new_uri)

Source: GitHub Commit

Detection Methods for CVE-2025-68696

Indicators of Compromise

• Outbound requests from application servers to unexpected internal IP ranges (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x, 169.254.169.254)
• Application logs showing HTTParty requests to URLs not matching the configured base_uri
• Unusual network traffic patterns from web servers to cloud metadata endpoints
• Evidence of API key or credential extraction in request logs

Detection Strategies

• Implement network monitoring for outbound connections from application servers to internal IP ranges or cloud metadata services
• Review application logs for HTTParty requests containing absolute URLs that differ from expected API endpoints
• Deploy web application firewall rules to detect SSRF patterns in request parameters
• Use SentinelOne Singularity to monitor for anomalous network behavior from Ruby application processes

Monitoring Recommendations

• Enable verbose logging for HTTParty requests to capture full request URLs and destinations
• Configure alerts for any outbound connections to RFC 1918 private IP addresses from production application servers
• Monitor for increased error rates or exceptions related to UnsafeURIError after patching
• Track DNS resolution requests for internal hostnames originating from web-facing applications

How to Mitigate CVE-2025-68696

Immediate Actions Required

• Upgrade HTTParty to a version containing commit 0529bcd6309c9fd9bfdd50ae211843b10054c240 or later
• Audit all application code that passes user-controlled input to HTTParty methods
• Implement allowlist validation for any URL parameters accepted by the application
• Review application logs for evidence of exploitation attempts

Patch Information

The vulnerability has been patched in HTTParty via commit 0529bcd. The fix introduces URI safety validation that raises an UnsafeURIError exception when an absolute URI is detected that doesn't match the configured base_uri. Organizations should update their Gemfile to specify a patched version and run bundle update httparty. For detailed patch information, see the GitHub Security Advisory and the commit details.

Workarounds

• Implement input validation to reject or sanitize any user-provided URLs before passing them to HTTParty
• Use network segmentation to restrict outbound connections from application servers
• Deploy a proxy or firewall rule to block requests to internal IP ranges from application servers
• Add application-level URL validation using Ruby's URI module to ensure URLs match expected patterns

# Example Gemfile update to patch HTTParty
# Update your Gemfile to require patched version
gem 'httparty', '>= 0.23.3'

# Then run bundle update
bundle update httparty

# Verify installed version
bundle info httparty