Light

Episode #853 Quiz

URL Parsing Vulnerabilities
Date: 2022-01-11 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Security researchers from SYNK and Claroty analyzed 16 URL parsers and found eight CVEs caused by inconsistent handling of schemes, slashes, backslashes, encoding, and mixed specifications. Differences between parsers enable SSRF, XSS, open redirects, filter bypasses, DoS, and sometimes RCE. Log4j’s whitelist bypass illustrated the danger, while careful RFC-compliant parsing mitigates it.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the specific bypass that defeated Log4j's first host whitelist fix for JNDI lookups?

Question 1

What was the specific bypass that defeated Log4j's first host whitelist fix for JNDI lookups?

Using ldap://localhost.evilhost.com:1389/a so the whitelist treated the attacker domain as a loopback alias Using ldap://evilhost.com/127.0.0.1:1389/a so the whitelist matched the path instead of the host Using ldap://127.0.0.1#.evilhost.com:1389/a so one parser saw localhost and another reached the attacker host Using ldap://[email protected]:1389/a so the whitelist accepted the userinfo field as a host

Question 2: Which combination of parser behavior and Python library mixup did Steve highlight as especially dangerous?

Question 2

Which combination of parser behavior and Python library mixup did Steve highlight as especially dangerous?

requests uses cURL for primary parsing while also using urllib3 and Wget in other places urllib uses urllib3 for primary parsing while also using requests' urlparse and urlsplit in other places requests uses urllib3 for primary parsing while also using urllib's urlparse and urlsplit in other places urllib3 uses requests for primary parsing while also using urllib's urlparse and urlsplit in other places

Question 3: How did Chrome's own URL-handling comment block describe malformed slash patterns in URLs?

Question 3

How did Chrome's own URL-handling comment block describe malformed slash patterns in URLs?

http:example.com is rejected, while http://example.com is the only accepted form http://////example.com is normalized to file:///example.com and then rejected http:\\example.com is rejected, while http://example.com is the only accepted form http:example.com, http:\\example.com, http:/example.com, and http://////example.com are all treated as valid

Question 4: What were the five inconsistency categories the researchers identified across URL parsers?

Question 4

What were the five inconsistency categories the researchers identified across URL parsers?

protocol confusion, delimiter confusion, encoding confusion, authority confusion, and redirect confusion syntax confusion, canonicalization confusion, normalization confusion, routing confusion, and caching confusion scheme confusion, slashes confusion, backslash confusion, URL encoded data confusion, and scheme mix-up host confusion, port confusion, path confusion, query confusion, and fragment confusion

Question 5: Which WordPress flaw described in the episode allowed exploitation only after the admin account had already been compromised?

Question 5

Which WordPress flaw described in the episode allowed exploitation only after the admin account had already been compromised?

A SQL injection via WP_Query with a CVSS of 8.0 An object injection issue with a CVSS of 6.6 A second SQL injection via WP_Meta_Query with a CVSS of 7.4 A cross-site scripting flaw abusing post slugs with a CVSS of 8.0

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.