CVE-2025-50182

Executive Summary

CVE-2025-50182 is a vulnerability in the urllib3 HTTP client library for Python, affecting versions 2.2.0 through 2.4.x. The flaw specifically impacts deployments using urllib3 within a Pyodide runtime (e.g., running Python in a browser via WebAssembly or Node.js). In these environments, urllib3 delegates HTTP requests to the JavaScript Fetch API or XMLHttpRequest, which handle redirects independently. The urllib3 library’s built-in redirect control and retry parameters are ignored, allowing an attacker to potentially force a client to follow unintended redirects. This can lead to open redirect scenarios, where a user’s browser or Node.js application is redirected to a malicious site without proper validation.

Supply Chain & Package Security

This vulnerability affects the urllib3 Python package, which is widely used as a dependency in thousands of projects. Organizations using urllib3 in Pyodide environments (e.g., JupyterLite, Pyodide-based web apps) must assess their exposure. The package is distributed via PyPI, and the fix is available in version 2.5.0. Supply chain risk is elevated because the vulnerability bypasses application-level redirect controls, potentially enabling phishing or data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low integrity impact reflects the ability to redirect a client to an attacker-controlled endpoint, but no direct data breach or service disruption.

Deep Dive & Mechanics

The vulnerability arises from a mismatch between urllib3’s internal redirect handling and the behavior of the underlying JavaScript runtime when urllib3 is used in a Pyodide environment. In standard Python, urllib3 controls redirects via the redirect parameter in HTTPAdapter.send(). However, in Pyodide, urllib3 uses the JavaScript Fetch API or XMLHttpRequest, which have their own redirect policies (e.g., redirect: 'follow' by default). The urllib3 library does not enforce its own redirect settings on these APIs, so an attacker can craft a response that causes the client to follow a redirect chain to an arbitrary URL.

Key technical points:

• Pyodide runs Python in the browser using WebAssembly, translating HTTP calls to JavaScript fetch/XHR.
• urllib3’s Retry and redirect parameters are ignored in this context.
• The JavaScript runtime’s default redirect behavior is to follow all redirects, including cross-origin ones.
• An attacker can exploit this by serving a response with a Location header pointing to a malicious site.

Vulnerable vs. Patched Code

Vulnerable (urllib3 < 2.5.0): In Pyodide, urllib3’s _make_request method does not pass redirect settings to the JavaScript fetch call. The code effectively does:

# Simplified vulnerable logic
response = await js.fetch(url, method=method, body=body, headers=headers)
# No redirect control applied

Patched (urllib3 >= 2.5.0): The fix ensures that when running in Pyodide, urllib3 intercepts redirects and applies its own policy. The patched code:

# Simplified patched logic
response = await js.fetch(url, method=method, body=body, headers=headers, redirect='manual')
# urllib3 then manually handles redirects based on its own settings

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target application using urllib3 in a Pyodide environment (e.g., a JupyterLite notebook or a custom web app).
• Ability to serve a malicious HTTP response that redirects.

Exploitation Steps:

1. Identify a Pyodide-based application that makes HTTP requests using urllib3.
2. Set up a malicious server that responds to the application’s request with a 302 redirect to an attacker-controlled site (e.g., https://evil.com/phish).
3. The victim’s browser will follow the redirect, potentially exposing sensitive data or credentials.

Example malicious server (Python):

from http.server import HTTPServer, BaseHTTPRequestHandler

class RedirectHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header('Location', 'https://evil.com/phish')
        self.end_headers()

HTTPServer(('0.0.0.0', 8080), RedirectHandler).serve_forever()

Blue Team

Detection:

• Monitor for unexpected redirects in Pyodide-based applications.
• Use network monitoring to detect connections to known malicious domains after a redirect.

Mitigation:

• Upgrade urllib3 to version 2.5.0 or later.
• If upgrade is not possible, implement a custom wrapper that validates redirect URLs before following them.
• Use Content Security Policy (CSP) headers to restrict allowed redirect destinations.

Indicators of Compromise (IOCs)

• Network: HTTP responses with Location header pointing to suspicious domains.
• Application Logs: Unexpected redirect chains in urllib3 logs (if enabled).
• File Hashes: No specific file hashes; focus on urllib3 package version.
• Behavior: Pyodide application making requests to unexpected URLs after initial request.

Detection Engineering

YARA Rule

rule CVE_2025_50182_urllib3_Pyodide_Redirect {
    meta:
        description = "Detects urllib3 versions vulnerable to redirect bypass in Pyodide"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50182"
    strings:
        $vuln_version = /urllib3[_-]v?2\.[2-4]\.\d+/
        $pyodide_import = "pyodide"
        $fetch_api = "js.fetch"
    condition:
        $vuln_version and ($pyodide_import or $fetch_api)
}

Sigma Rule

title: CVE-2025-50182 - urllib3 Redirect Bypass in Pyodide
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects urllib3 versions 2.2.0 to 2.4.x used in Pyodide environments
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: python
detection:
    selection:
        package: urllib3
        version:
            - '2.2.0'
            - '2.2.1'
            - '2.3.0'
            - '2.4.0'
    condition: selection
falsepositives:
    - Legitimate use of older urllib3 versions in non-Pyodide environments
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50182 - urllib3 Pyodide Redirect Bypass"; flow:to_server; content:"Location"; http_header; pcre:"/Location:\s*https?:\/\/[^\/]*evil\.com/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade urllib3 to version 2.5.0 or later.
2. Workaround: If upgrade is not possible, implement a custom HTTP adapter that validates redirect URLs before following them.
3. Long-term: Review all dependencies for similar issues in Pyodide environments.
4. Monitoring: Enable logging for urllib3 redirects and monitor for unexpected behavior.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst