8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68696

CVE-2025-68696: httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. This issue has been patched via commit 0529bcd.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68696

CVE-2025-68696:

8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
httparty	rubygems	<= 0.23.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-hm5p-x4rq-38w4, is a Server-Side Request Forgery (SSRF) flaw in the httparty library. The root cause is the improper handling of absolute URLs when a base_uri is configured. The analysis of the fixing commit 0529bcd6309c9fd9bfdd50ae211843b10054c240 points to the HTTParty::Request.uri method as the source of the vulnerability.

When a developer sets a base_uri for an HTTParty client, the expectation is that all subsequent requests will be directed to that domain. However, the uri method in lib/httparty/request.rb failed to enforce this. If the path argument passed to a request method (like .get or .post) was a full, absolute URL (e.g., http://malicious-site.com), the library would ignore the base_uri and send the request to the attacker-controlled URL instead.

This is a security risk because if the path can be influenced by user input, an attacker can force the application to make requests to arbitrary servers. This can be used to exfiltrate sensitive data, such as API keys or authentication tokens, which are often sent as default headers. It also allows attackers to probe internal networks accessible from the application server.

The patch rectifies this by introducing a new validate_uri_safety! method that is called from within the uri method. This new function explicitly checks if the host of the requested URL matches the host of the configured base_uri. If there is a mismatch, it raises an UnsafeURIError, effectively stopping the malicious request. Therefore, the HTTParty::Request.uri function is identified as the vulnerable function because it lacked this critical validation.

Vulnerable functions

HTTParty::Request.uri

lib/httparty/request.rb

The `uri` method in the `HTTParty::Request` class is responsible for constructing the final request URI. Prior to the patch, if the `path` argument provided to a request was an absolute URL, this method would use it directly without validating it against the configured `base_uri`. This allowed an attacker to provide a URL to a server they control, causing the application to make a request to an arbitrary server. This could lead to the leakage of sensitive credentials (like API keys sent in headers) and enable Server-Side Request Forgery (SSRF) attacks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.