Addressable display_uri can show misleading hosts with invalid Punycode A-labels

Impact

Addressable::IDNA.to_unicode, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with xn--) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:

• labels that decode to only ASCII characters, e.g. xn--google- decodes to google;
• labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form.

Addressable::URI#display_uri uses to_unicode, so for https://xn--google-.example.org/ it displays the host google.example.org, while #host, #normalized_host and any connection made from the URI use xn--google-.example.org. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of to_unicode against a list of trusted names can likewise treat two different hosts as the same.

The native IDNA implementation, used when libidn and the idn-ruby gem are installed, is not affected. to_ascii and normalized_host are not affected.

Affected Versions

This vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.

Workarounds

• Install libidn and the idn-ruby gem, so that Addressable uses the native IDNA implementation.
• Don't make security decisions on display_uri or to_unicode output. Compare hosts using normalized_host.

Credits

Reported by @tonghuaroot.

For more information

If there are any questions or comments about this advisory:

• Open an issue