CVE-2021-41945
📋 TL;DR
CVE-2021-41945 is an improper input validation vulnerability in the httpx Python library that allows attackers to manipulate URL parsing to bypass security controls or cause denial of service. It affects applications using httpx for HTTP client operations. Developers using httpx versions below 0.23.0 are impacted.
💻 Affected Systems
- httpx
📦 What is this software?
Httpx by Encode
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass URL validation, security filters, or access controls, potentially leading to server-side request forgery (SSRF), authentication bypass, or denial of service.
Likely Case
Most commonly exploited to bypass URL-based security filters, manipulate request routing, or cause application crashes through malformed URLs.
If Mitigated
With proper input validation and URL sanitization at the application layer, impact is limited to potential minor disruptions.
🎯 Exploit Status
Exploitation requires sending specially crafted URLs to vulnerable endpoints. Public proof-of-concept code demonstrates URL manipulation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.23.0
Vendor Advisory: https://github.com/encode/httpx/security/advisories/GHSA-8hfj-vvxq-3p3g
Restart Required: No
Instructions:
1. Update httpx to version 0.23.0 or higher using pip: pip install httpx>=0.23.0
2. Verify no breaking changes in your application
3. Test URL handling functionality
🔧 Temporary Workarounds
Input Validation Wrapper
allImplement custom URL validation before passing to httpx functions
URL Sanitization
allSanitize and normalize all URLs before httpx processing
🧯 If You Can't Patch
- Implement strict input validation for all URL parameters
- Use web application firewall (WAF) rules to filter suspicious URL patterns
🔍 How to Verify
Check if Vulnerable:
Check httpx version: python -c "import httpx; print(httpx.__version__)" and verify if < 0.23.0Check Version:
python -c "import httpx; print('httpx version:', httpx.__version__)"Verify Fix Applied:
After update, verify version is >= 0.23.0 and test URL handling with edge cases📡 Detection & Monitoring
Log Indicators:
- Unusual URL patterns in httpx requests
- Application errors related to URL parsing
- Unexpected outbound HTTP requests
Network Indicators:
- HTTP requests with malformed or unusual URL structures
- Requests bypassing expected URL validation
SIEM Query:
httpx OR python AND (url_validation OR parsing_error) AND version<0.23.0🔗 References
- http://encode.com
- https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
- https://github.com/encode/httpx
- https://github.com/encode/httpx/discussions/1831
- https://github.com/encode/httpx/issues/2184
- https://github.com/encode/httpx/releases/tag/0.23.0
- http://encode.com
- https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
- https://github.com/encode/httpx
- https://github.com/encode/httpx/discussions/1831
- https://github.com/encode/httpx/issues/2184
- https://github.com/encode/httpx/releases/tag/0.23.0
