Critical Web3.py Vulnerability: Smart Contracts Can Force HTTP Requests to Arbitrary, Unsafe URLs

A critical security flaw in the widely used Ethereum Python library, web3.py, allows smart contracts to force client applications to make HTTP requests to arbitrary, potentially malicious URLs. The vulnerability, tracked as GHSA-5hr4-253g-cpx2, resides in the library's implementation of the CCIP Read / OffchainLookup (EIP-3668) standard. This feature is designed to fetch data from off-chain sources, but the current implementation blindly trusts URLs provided directly by smart contracts without any validation.

The core of the issue is that the library performs HTTP requests using contract-supplied URLs after simple template substitution. Crucially, it lacks fundamental security controls: it does not restrict requests to secure HTTPS protocols, has no hostname or IP allowlist, and fails to block requests to private or reserved IP ranges like loopback or link-local addresses. This creates a direct vector for attackers to manipulate smart contracts, forcing downstream applications and their users to connect to unsafe or attacker-controlled endpoints.

This vulnerability exposes a significant supply chain risk for the entire Ethereum and Web3 development ecosystem. Any application or service relying on the affected versions of web3.py to interact with smart contracts using CCIP Read is potentially vulnerable. The flaw could be exploited for phishing, data exfiltration, denial-of-service attacks against internal networks, or as a stepping stone for further compromise. The maintainers have released version 6.20.4 to address this issue, making an immediate dependency update a critical security priority for all projects.