Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix insecure HTTP connection to HTTPS in MelissaStandardizingVendor.py. #327

Open
wants to merge 1 commit into
base: add-test-for-streaming
Choose a base branch
from

Conversation

zeropath-ai[bot]
Copy link

@zeropath-ai zeropath-ai bot commented Aug 9, 2024

Summary

  • The Vulnerability Description: The application was using an insecure HTTP connection to communicate with the Melissa Data API, which could expose sensitive data to man-in-the-middle attacks.
  • This Fix: The fix updates the connection method to use HTTPS, ensuring that the data transmitted is encrypted and secure.
  • The Cause of the Issue: The original implementation used an HTTP URL for the API endpoint, which is not encrypted and can be intercepted by malicious actors.
  • The Patch Implementation: The patch modifies the URL in the Python file melissa_standardizing_vendor.py from http://address.melissadata.net/v3/WEB/GlobalAddress/doglobaladdress to https://address.melissadata.net/v3/WEB/GlobalAddress/doglobaladdress, ensuring that the API requests are now sent over a secure HTTPS connection.

Vulnerability Details

  • Vulnerability Class: Server Side Request Forgery (SSRF)
  • Severity: 6.5
  • Affected File: spark_pipeline_framework/utilities/helix_geolocation/v2/vendors/melissa_standardizing_vendor.py
  • Vulnerable Lines: 217-217

Code Snippets

diff --git a/spark_pipeline_framework/utilities/helix_geolocation/v2/vendors/melissa_standardizing_vendor.py b/spark_pipeline_framework/utilities/helix_geolocation/v2/vendors/melissa_standardizing_vendor.py
index 4cfcc24..5fe9159 100644
--- a/spark_pipeline_framework/utilities/helix_geolocation/v2/vendors/melissa_standardizing_vendor.py
+++ b/spark_pipeline_framework/utilities/helix_geolocation/v2/vendors/melissa_standardizing_vendor.py
@@ -202,7 +202,7 @@ class MelissaStandardizingVendor(
         ]
 
         license_key = self._get_request_credentials()["license_key"]
-        url = r"http://address.melissadata.net/v3/WEB/GlobalAddress/doglobaladdress"
+        url = r"https://address.melissadata.net/v3/WEB/GlobalAddress/doglobaladdress"
         json_batch_dict = {
             "TransmissionReference": "GlobalAddressBatch",
             "CustomerID": license_key,

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the ZeroPath bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai!

To request modifications, please post a comment beginning with @zeropath-ai and specify the changes required.

@zeropath-ai will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout ZeroPath created branch:
git checkout zeropath_fix_server_side_request_forgery_ssrf_1723220361935104

# if vscode is installed run (or use your favorite editor / IDE):
code spark_pipeline_framework/utilities/helix_geolocation/v2/vendors/melissa_standardizing_vendor.py

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zeropath_fix_server_side_request_forgery_ssrf_1723220361935104

Note: This is a part of your free trial, please click here to upgrade your plan to release all the patches.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants