CVE-2025-47241

Executive Summary

CVE-2025-47241 is a vulnerability in the browser-use (also known as Browser Use) Python library, affecting versions prior to 0.1.45. The flaw lies in the URL parsing logic for the allowed_domains security feature. An attacker can bypass domain restrictions by embedding userinfo (e.g., username:password@) in the authority component of a URL. This allows a malicious actor to make the library navigate to or interact with domains that were not explicitly permitted, potentially leading to unauthorized data access or actions within the browser automation context.

The vulnerability has a CVSS score of 4.0 (Medium), with a low attack complexity and no privileges required. No public proof-of-concept (PoC) or exploit code is currently available. The vendor has released a patch in version 0.1.45.

Supply Chain & Package Security

This vulnerability affects the browser-use Python package, which is distributed via PyPI. Organizations using this library for browser automation tasks should immediately review their dependency manifests and update to the patched version. Since this is a Python package, supply chain risks include dependency confusion, typosquatting, or malicious forks. Ensure that the package is sourced from the official PyPI repository and that integrity hashes are verified during installation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.0 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): Low (L) – The attacker can manipulate the target domain.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for bypassing security controls in automated browser sessions makes this a significant concern for security-conscious deployments.

Deep Dive & Mechanics

The browser-use library implements an allowed_domains feature to restrict which URLs the automated browser can navigate to. This is intended to prevent the browser from accessing arbitrary external domains, which could be used for data exfiltration or malicious redirection.

The vulnerability arises from improper parsing of the URL authority component. According to RFC 3986, a URI authority can include a userinfo subcomponent in the format userinfo@host:port. The library's domain validation logic fails to correctly strip or ignore the userinfo part before comparing the host against the allowed list.

For example, if the allowed domain is example.com, an attacker can craft a URL like:

http://evil.com:password@example.com/

In many URL parsers, the actual host is example.com, but the userinfo contains evil.com:password. If the library only checks the full authority string or misparses the host, it may incorrectly allow the URL because it sees example.com in the string, while the browser actually navigates to evil.com (depending on the browser's URL handling).

This bypass allows an attacker to:

• Redirect the automated browser to a malicious site.
• Perform phishing or credential harvesting.
• Exfiltrate data to an unauthorized domain.
• Execute actions on unintended web applications.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.1.45): The vulnerable code likely used a simple string containment check or a naive URL parsing that did not account for the userinfo component.

# Vulnerable example (conceptual)
def is_allowed(url, allowed_domains):
    parsed = urlparse(url)
    host = parsed.hostname
    # Incorrect: does not strip userinfo
    for domain in allowed_domains:
        if domain in host:
            return True
    return False

Patched Code (version 0.1.45): The patched version properly parses the URL and extracts only the hostname, ignoring the userinfo component.

# Patched example (conceptual)
def is_allowed(url, allowed_domains):
    parsed = urlparse(url)
    # Correct: extract hostname only, ignoring userinfo
    host = parsed.hostname
    if host is None:
        return False
    for domain in allowed_domains:
        if host == domain or host.endswith('.' + domain):
            return True
    return False

The key fix is ensuring that parsed.hostname is used instead of a raw string that might include userinfo. The patched code also uses exact matching or suffix matching to prevent subdomain bypasses.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target application using browser-use with allowed_domains configured.
• Ability to inject a URL into the browser automation (e.g., via a web form, API, or redirect).

Exploitation Steps:

1. Identify the allowed domain(s) in the target configuration (e.g., trusted-site.com).
2. Craft a malicious URL that includes userinfo pointing to an attacker-controlled domain:

   http://attacker.com:password@trusted-site.com/malicious-path
   

3. Submit this URL to the vulnerable application.
4. The browser-use library will incorrectly validate the URL as allowed (because trusted-site.com appears in the authority), but the browser may navigate to attacker.com (depending on browser behavior).
5. The attacker can then serve a malicious page that performs actions within the browser session, such as stealing cookies, performing CSRF attacks, or exfiltrating data.

Lab Setup:

• Use a local Python environment with browser-use version < 0.1.45.
• Set up a simple web server (e.g., Flask) that uses browser-use to navigate to user-supplied URLs.
• Configure allowed_domains to include a benign domain (e.g., example.com).
• Use a tool like ngrok to expose an attacker-controlled server.
• Test the crafted URL and observe the browser's behavior.

Blue Team (Detection & Defense)

Detection:

• Monitor for URLs containing the @ symbol in the authority component, especially if they appear in browser automation contexts.
• Log and alert on any navigation attempts to domains that do not match the expected pattern after URL parsing.
• Use network monitoring to detect connections to unexpected external domains from browser automation processes.

Defense:

• Immediately upgrade to browser-use version 0.1.45 or later.
• Implement additional input validation and sanitization for URLs before passing them to the library.
• Use a web application firewall (WAF) to block URLs with suspicious userinfo components.
• Restrict outbound network access from browser automation environments to only allowlisted domains.

Indicators of Compromise (IOCs)

• URLs containing @ in the authority component (e.g., http://evil.com:password@trusted-site.com/).
• Unexpected outbound connections from browser automation processes to domains not in the allowed list.
• Log entries showing navigation to domains that differ from the parsed hostname.
• Anomalous browser behavior such as redirects to unknown sites or unexpected form submissions.

Detection Engineering

YARA Rule

rule CVE_2025_47241_BrowserUse_URL_Bypass {
    meta:
        description = "Detects URLs with userinfo in authority component that may bypass browser-use allowed_domains"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2025-47241"
        severity = "medium"
    strings:
        $url_pattern = /https?:\/\/[^@\/]+@[^\/]+\//
    condition:
        $url_pattern
}

Sigma Rule

title: CVE-2025-47241 - Browser-Use allowed_domains Bypass via Userinfo
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects URLs containing userinfo in the authority component, indicating potential exploitation of CVE-2025-47241.
author: Valters IT
date: 2025-04-14
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47241
logsource:
    category: application
    product: browser-use
detection:
    selection:
        url|contains: "@"
    condition: selection
falsepositives:
    - Legitimate use of userinfo in URLs (e.g., basic auth in internal tools)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47241 - Browser-Use allowed_domains Bypass via Userinfo"; flow:to_server; content:"@"; http_uri; pcre:"/https?:\/\/[^@\/]+@[^\/]+\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade browser-use to version 0.1.45 or later.
2. Review all dependencies and ensure no other packages are affected by similar URL parsing issues.
3. Audit logs for any signs of exploitation, such as URLs with userinfo components.

Long-Term Mitigations:

• Implement strict input validation for all URLs processed by browser automation.
• Use a dedicated URL parsing library that correctly handles RFC 3986 components.
• Apply the principle of least privilege to browser automation sessions.
• Regularly update and patch all software components.

Workarounds (if patching is not immediately possible):

• Manually strip userinfo from URLs before passing them to browser-use.
• Implement a proxy that validates and sanitizes URLs before they reach the library.
• Restrict the browser automation environment to a sandboxed network with egress filtering.

Valters IT
Securing Digital Frontiers