CKAN CVE-2025-73845: Server-Side Request Forgery via Unanchored Regex in MQA Server Allowlist

Vulnerability Overview Vulnerability Name: MQA server allowlist bypass via unanchored regex ( ) Description: The tools and restrict their parameter to using a regular expression. This regular expression is anchored only at the beginning and lacks a boundary at the end. Consequently, any URL starting with or using as the URL userinfo can bypass validation, allowing an attacker to interact with a host they control. Impact Scope Affected Versions: < 0.4.111 Fixed Versions: 0.4.111 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None CVE ID: CVE-2025-73845 Weaknesses: - CWE-20 - CWE-625 - CWE-918 Remediation Validate the parsed hostname rather than the raw string. For example: Anchor the regular expression to the end ( ) can also mitigate suffix tricks, but URL parsing combined with exact hostname comparison is a more robust fix that also neutralizes variants. Proof of Concept (POC) Affected Code All of the following return : After passing this check, flows into / , invoking . The server then makes a request to the attacker-controlled host and returns the (parsed) response to the caller. Impact The intended "data.gov.it only" trust boundary is broken; destinations can be driven to arbitrary external hosts. The attacker's host receives requests (including ) and controls the response returned to the module loader—enabling response spoofing and, in attacker scenarios, injecting prompt injection content under the guise of a trusted tool. Increases the SSRF attack surface: while blocks private/internal IPs, this bypass removes the domain restrictions enforced by the code. The variant is the most severe form, as validation passes for a string whose actual host is entirely selected by the attacker.

Goal Reached Thanks to every supporter — we hit 100%!

CKAN CVE-2025-73845: Server-Side Request Forgery via Unanchored Regex in MQA Server Allowlist

More from this source