A critical security vulnerability has been identified in Python’s URL parsing function, urllib.parse, specifically affecting its ability to correctly handle URLs starting with blank characters. This flaw, assigned the identifier CVE-2023-24329 with a CVSS score of 7.5, poses a risk as it can be exploited to circumvent domain or protocol blocklists, potentially leading to unauthorized file access and command execution.
The issue, disclosed by the CERT Coordination Center, affects hostname and scheme parsing, rendering blocklisting methods ineffective. Discovered and reported by security researcher Yebo Cao in August 2022, this vulnerability is a result of inadequate input validation. Attackers can exploit it by using URLs prefixed with blank characters, such as ” https://youtube[.]com“, to bypass blocklist-based security measures.
CVE-2023-24329 has been addressed in Python versions 3.12 and later, as well as in patched updates for earlier versions (3.11.4, 3.10.12, 3.9.17, 3.8.17, and 3.7.17). Despite blocklisting being a less preferred security approach, it is still widely used, making this vulnerability particularly concerning for scenarios involving server-side request forgery (SSRF) and remote code execution (RCE).
This disclosure highlights a broader issue in Python’s security management, where many fixes are implemented through “silent” code commits without a CVE identifier, potentially leaving unpatched systems vulnerable to undisclosed exploits.