🔒 Fix SSRF vulnerability in std.web.fetch - #52
Conversation
This commit addresses a Server-Side Request Forgery (SSRF) vulnerability in the `fetch` function of the standard `web` module. Previously, user-provided URLs were passed directly to `ureq::get`, allowing attackers to probe internal networks, access metadata services (like 169.254.169.254), or hit loopback addresses. The fix introduces a custom `SafeResolver` for the `ureq` client that blocks resolution of private, loopback, link-local, broadcast, and unspecified IP addresses (for both IPv4 and IPv6, including IPv4-mapped IPv6 addresses). By doing this at the resolver level, we prevent DNS rebinding (TOCTOU) attacks. Additionally, HTTP redirects are explicitly disabled (`.redirects(0)`) to prevent bypasses where an external safe server redirects to an internal malicious IP. Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🎯 What: Fixed an SSRF (Server-Side Request Forgery) vulnerability in
⚠️ Risk: Attackers could supply URLs pointing to internal infrastructure (
stdlib/src/web.rswhere thefetchfunction blindly retrieved user-provided URLs.127.0.0.1, AWS metadata169.254.169.254, internal subnets), exposing sensitive internal data, configuration, or performing unauthorized actions on internal APIs.🛡️ Solution: Implemented a robust validation mechanism:
urlcrate to parse and validate incoming URLs.ureq::Resolver(SafeResolver) that filters out all private, loopback, link-local, broadcast, and unspecified IP addresses (IPv4 and IPv6). This resolves the IP at connection time, preventing DNS rebinding (TOCTOU) attacks.ureqHTTP agent with.redirects(0)to prevent attackers from bypassing the check via 3xx redirects to internal IPs.PR created automatically by Jules for task 2495096785143464329 started by @Tcode-Motion