CyberRota Analysis
AI-GeneratedThe vulnerability in the Slab safeurl library allows an attacker with control over a hostname's DNS responses to exploit a Time-of-check Time-of-use (TOCTOU) race condition, potentially redirecting HTTP requests to unauthorized internal network destinations. This critical flaw, present in safeurl versions 0.1.0 and later, poses a significant risk to applications relying on this library for URL validation. Organizations utilizing safeurl should prioritize immediate remediation to mitigate the risk of unauthorized access to sensitive internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses. This issue affects safeurl: from 0.1.0 onward.