Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

guest · Jan 10, 2022

January 10, 2022

A study of 16 different Uniform Resource Locator (URL) parsing libraries has unearthed inconsistencies and confusions that could be exploited to bypass validations and open the door to a wide range of attack vectors.

In a deep-dive analysis jointly conducted by cybersecurity firms Claroty and Synk, eight security vulnerabilities were identified in as many third-party libraries written in C, JavaScript, PHP, Python, and Ruby languages and used by several web applications.

"The confusion in URL parsing can cause unexpected behavior in the software (e.g., web application), and could be exploited by threat actors to cause denial-of-service conditions, information leaks, or possibly conduct remote code execution attacks," the researchers said in a report shared with The Hacker News.
Click to expand...

Indeed, the use of multiple parsers emerged as one of the two primary reasons why the eight vulnerabilities were discovered, the other being issues arising from inconsistencies when the libraries follow different URL specifications, effectively introducing an exploitable loophole.

"Many real-life attack scenarios could arise from different parsing primitives," the researchers said. To protect applications from URL parsing vulnerabilities, "it is necessary to fully understand which parsers are involved in the whole process [and] the differences between parsers, be it their leniency, how they interpret different malformed URLs, and what types of URLs they support."
Click to expand...

Claroty: Exploiting URL Parsing Confusion Vulnerabilities

Executive Summary
• Team82 and the Snyk research team collaborated on a research paper, available today, that examines URL parsing confusion.
• Different libraries parse URLs in their own way, and these inconsistencies can be abused by attackers
• We examined 16 URL parsing libraries including: urllib (Python), urllib3 (Python), rfc3986 (Python), httptools (Python), curl lib (cURL), Wget, Chrome (Browser), Uri (.NET), URL (Java), URI (Java), parse_url (PHP), url (NodeJS), url-parse (NodeJS), net/url (Go), uri (Ruby) and URI (Perl).
• Our paper describes five classes of inconsistencies between parsing libraries that can be exploited to cause denial-of-service conditions, information leaks, and under some circumstances, remote code execution
• The five types of inconsistencies are: scheme confusion, slashes confusion, backslash confusion, URL encoded data confusion, and scheme mixup.
• The Team82-Snyk research collaboration also uncovered eight vulnerabilities in web applications and third-party libraries (many written in different programming languages) used by web developers in apps
• Among the eight vulnerabilities was a bug in libcurl. The issue was disclosed to cURL creator Daniel Stenberg, who patched it in the latest cURL version.
Click to expand...

Log in or Sign up

Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

guest Guest

Log in or Sign up

Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

guest Guest

Useful Searches