Auth SSRF in AstrBot Plugin Update Endpoint via download_url/proxy

Vulnerability Overview Title: Authenticated Server-Side Request Forgery (SSRF) via User-Controlled , , and in AstrBot Plugin Update Endpoint Description: AstrBot’s authenticated dashboard plugin update process allows logged-in dashboard users to redirect server-side plugin download requests to attacker-chosen destinations. By providing or , or by abusing the field, an attacker can force the AstrBot server to initiate outbound HTTP GET requests to any reachable host. This vulnerability exists prior to any plugin archive validation or extraction, representing a true SSRF primitive on the plugin lifecycle surface, rather than merely a consequence of intentionally installing plugin code. Scope Ecosystem: GitHub Package: AstrBot Affected Versions: <= 4.25.2 Fixed Versions: Not provided Remediation Fixed Versions: Not provided Proof of Concept (POC) Code Evidence Logs Verification Run: Control Run: AstrBot Runtime Evidence: Impact This is an authenticated Server-Side Request Forgery (SSRF) vulnerability on the plugin lifecycle surface. Dashboard users can use the plugin update operation to cause the AstrBot server to issue HTTP requests to arbitrary destinations reachable by the server, including: Loopback services bound only to 127.0.0.1 Internal RFC1918 services Private mirrors, admin panels, CI/CD endpoints, registries, and monitoring services Cloud metadata services (if network policies do not block them) Secondary destinations based on redirects followed automatically This vulnerability grants the attacker the server's network perspective, which can be used for internal network scanning and access to HTTP-reachable internal services that are not directly exposed to the attacker. Weakness CWE: CWE-918: Server-Side Request Forgery (SSRF) Occurrence Permalinks: - https://github.com/AstrBotDevs/AstrBot/blob/0e973bd44483d18e1672c4dfa2eb7aae31bc183/astrbot/dashboard/routes/plugin.py#L1853 - https://github.com/AstrBotDevs/AstrBot/blob/0e973bd44483d18e1672c4dfa2eb7aae31bc183/astrbot/core/star/updater.py#L2 - https://github.com/AstrBotDevs/AstrBot/blob/0e973bd44483d18e1672c4dfa2eb7aae31bc183/astrbot/core/zip_updater.py#L4 - https://github.com/AstrBotDevs/AstrBot/blob/0e973bd44483d18e1672c4dfa2eb7aae31bc183/astrbot/core/zip_updater.py#L5 - https://github.com/AstrBotDevs/AstrBot/blob/0e973bd44483d18e1672c4dfa2eb7aae31bc183/astrbot/core/zip_updater.py#L2

Goal Reached Thanks to every supporter — we hit 100%!

Auth SSRF in AstrBot Plugin Update Endpoint via download_url/proxy