idna accepts Punycode labels that do not produce any non-ASCII when decoded

Root

Cause CVE-2024-12224 affects the idna crate (versions ≤0.5.0) used by Servo’s rust-url library. The vulnerability is an improper validation of unsafe equivalence in punycode: the crate accepts punycode labels that, when decoded, produce no non-ASCII characters. This means a hostname like xn--test-.example.com is treated as equivalent to test.example.com after processing, even though the two forms are lexically distinct [1][3]. The root cause lies in the IDNA processing logic not rejecting labels that collapse to an ASCII-only result, breaking the assumption that different representations remain different after normalization.

Exploitation

An attacker can craft a punycode hostname (e.g., xn--example-.org) that one component of a system treats as distinct while another component (using the vulnerable idna crate) treats as equal to a different hostname (e.g., example.org). This affects any application or library that uses rust-url for URL parsing, including JavaScript runtimes like Deno and WinterJS, HTTP libraries like reqwest, and Discord’s OGP previewer [1]. The attacker does not need authentication; they only need to craft a malicious URL. The bug can be triggered in scenarios where URL comparison is performed, such as CSRF protection checks in web frameworks—the Hono framework was confirmed as exploitable because it compares URL and Origin headers after normalization [1].

Impact

Successful exploitation allows an attacker to bypass security mechanisms that rely on URL equivalence, such as same-origin policy enforcement or CSRF token validation. For example, a request to a malicious domain could be normalized to a trusted domain, potentially leading to unauthorized actions on behalf of a victim user. The vulnerability does not require network access beyond delivering the crafted URL to the target application; it is a logic flaw in URL normalization that undermines trust boundaries [1][2][3].

Mitigation

The idna crate has been patched in version 1.0.0. Users should update their dependency on idna to version 1.0.0 or later. The rust-url library itself provides an upgrade path; if your application depends on url or any indirect dependency that uses idna, ensure you are using a version that pulls in the patched crate [3][4]. For applications that cannot immediately upgrade, implementing additional validation of hostnames before relying on rust-url normalization may serve as a temporary workaround.