CyberRota Analysis
AI-GeneratedThis vulnerability affects versions up to 0.5.2, allowing attackers to exploit a server-side request forgery (SSRF) bypass by manipulating URL parsing differences between net.urllib and net.http. By crafting a specific URL with a backslash, attackers can bypass host-based allowlists, gaining unauthorized access to internal network services. Organizations using affected versions should prioritize patching to mitigate the risk of internal network exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.