AdLoop SSRF mitigation and multi-tenant isolation fix

Vulnerability Overview The webpage screenshot displays a code commit regarding multi-tenant runtime context and pluggable security backends. It primarily involves improvements to the AdLoop runtime environment, including configuration loading in local mode, configuration parsing in server mode, schedule storage, authentication provider interfaces, and SSRF (Server-Side Request Forgery) protection. Impact Scope Multi-tenant Runtime Context: Affects configuration loading and parsing in both local and server modes of AdLoop. Schedule Storage: Affects tenant-based schedule storage, ensuring that drafts from one tenant are not visible to other tenants. Authentication Provider Interface: Affects the authentication process in both local and server modes, particularly OAuth and Google API authentication. SSRF Protection: Affects URL validation and image asset processing in AdLoop to prevent security issues caused by malicious URLs. Remediation 1. Multi-tenant Runtime Context: - Local Mode: Load configuration from ; Server Mode: Parse configuration per request. - Server Mode: Remove module-level configuration; all tools parse configuration via the current context. - Importing AdLoop Server now operates independently (no configuration reading, no signal handling, no SDK patches). 2. Schedule Storage: - Schedule Storage: Use tenant-based schedule keys so that drafts for one tenant are hidden from others. - Audit Log Interface: Use tenant-tagged audit logs. 3. Authentication Provider Interface: - Local Provider: Reject server mode; OAuth fallback is enabled only on real endpoints. - Server Mode: Use the interface; the local provider rejects server mode, and OAuth fallback is enabled only on real endpoints. 4. SSRF Protection: - URL Validation: Reject URLs that resolve to non-public addresses to prevent SSRF attacks. - Image Assets: Implement block check operations to prevent malicious image assets. POC Code / Exploit Code ```python def _get_credentials_path(config: AdLoopConfig) -> Path """Resolve OAuth client credentials using a priority chain.""" return None def _get_gad_credentials(config: AdLoopConfig) -> Credentials: """Return authenticated credentials for GAA APIs.""" creds_path = _get_credentials_path(config) if creds_path is not None: import json with open(creds_path) as f: creds_info = json.load(f) if creds_info.get("type") == "service_account": from google.oauth2 import service_account return service_account.Credentials.from_service_account_file( str(creds_path), scopes=_GAD_SCOPES, ) return _oauth_flow(config, creds_path) import google.auth credentials, _ = google.auth.default(scopes=_GAD_SCOPES) return credentials def _get_ads_credentials(config:

Goal Reached Thanks to every supporter — we hit 100%!

AdLoop SSRF mitigation and multi-tenant isolation fix

More from this source