Internet Bug Bounty · Report #305978
Urllib connects to a wrong host
Validstatus
lowseverity
$500bounty
6upvotes
12 Nov 2019disclosed
Summary
The urllib module doesn’t parse correctly password containing the # character.
- Disclosure date: 2017-05-29 (Python issue #30500 reported)
- Reported at: 2017-03-04 (Orange Tsai on the PSRT list)
How it was found
Description
The inconsistent of URL parsing and URL fetching are distinct
Original bug report
- https://bugs.python.org/issue30500
- http://python-security.readthedocs.io/vuln/bpo-30500_urllib_connects_to_a_wrong_host.html
Note
- None
Thanks :)
Impact
SSRF