Unauthenticated SSRF in Kolibri RemoteFacilityUserViewset: Analysis and Impact

Vulnerability Overview Vulnerability Name: Unauthenticated Server-Side Request Forgery (SSRF) in Kolibri Vulnerability Description: Multiple Kolibri API endpoints accept an unvalidated parameter and retrieve content from attacker-controlled URLs. The initial report identified reflection points on two endpoints; a fix review revealed two additional reflection points operating under the same pattern. The GET endpoint is unauthenticated. Scope of Impact Affected Endpoints: - - (kolibri/core/auth/api.py:1578). No authentication required. - - (kolibri/core/auth/api.py:1594). Authentication is performed against the remote server, not local Kolibri. - - Remote signature proxy for the setup wizard (kolibri/plugin/setup_wizard/api.py). Accessible on unconfigured devices. - - (kolibri/core/discovery/api.py). Uses the same pattern without proper authentication. Root Cause: 1. Response Reflection - These endpoints return the remote server's JSON body to the caller more or less intact ( , , etc.). 2. Insufficient Restriction on Remote Targets - is only validated by . will connect to any host that returns a valid Kolibri-shaped response at . Requests follow 303 redirects by default, allowing a malicious peer to redirect the fetch to arbitrary hosts (cloud metadata, internal services) before reflection occurs. Two Reflection Vectors: - GET Vector ( ): The viewset fetches and returns . An attacker-controlled returns a 302 redirect to any internal URL. The request follows the redirect, and the body of the redirect response is returned to the attacker. - POST Vector ( ): fetches and uses basic authentication. The viewset returns . A malicious returns forged user-shaped JSON, reflecting arbitrary smuggled fields back to the caller. The setup wizard and endpoints have the same shape on different remote URLs. Reproduction: The vulnerability can be reproduced by pointing to an attacker-controlled HTTP server: 1. Respond to with a valid Kolibri info payload (so succeeds). 2. GET Vector: Respond to with a 302 redirect to the target URL. The body of the redirect response is reflected via . 3. POST Vector: Respond to the relevant remote URL with forged JSON containing extra fields. The entire JSON is reflected. Demonstrated Impact (Pre-fix): - Unauthenticated outbound requests from the Kolibri server to any HTTP(S) URL chosen by the attacker (only the GET endpoint; others require authentication or an unconfigured device). - Reflected data exfiltration for any HTTP endpoint that responds to a flat GET request with JSON and no special request headers. - Cloud metadata accessibility is realistic but service-specific: - AWS IMDSv1 - Accessible - DigitalOcean - Accessible - GCP/Azure, AWS IMDSv2 - Not accessible via this vector (requires / token headers, which the attacker cannot inject) - Accessibility of internal HTTP services on the same network as the Kolibri server, with their JSON responses returned to the attacker. Not Demonstrated: Early drafts asserted port scanning via timing oracles and generic "internal network mapping." The reflection vectors read the response body directly when the target serves JSON. Timing scans of arbitrary TCP services were not demonstrated, nor are they a timing risk. Remediation Four-Layer Defense: 1. Response Sanitization: Each affected endpoint now enforces a documented shape for the remote response before returning it. Smuggled fields are discarded. 2. Authentication: Previously open endpoints now require caller authentication (except for unconfigured devices in the setup wizard flow). 3. Cross-Host Redirect Blocking: The remote fetch HTTP session rejects 303 redirects pointing to different hostnames. Same-host redirects remain functional. 4. Peer Whitelisting: Endpoints accepting caller-provided now resolve only to peers known to Kolibri, rather than connecting to arbitrary hosts. Discovery and CLI flows require probing new addresses using a separate code path. Fixed Versions Affected Versions: = 0.19.4 Additional Information CVE ID: CVE-2024-8053 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: None - Availability: None Weakness: CWE-918 Credit: - The initial report and identification of the viewsets were provided by @beraouadelkhaliek. Additional vector identification and the fix were completed by Kolibri maintainers based on a reflection-based POC. - The original report was provided by @beraouadelkhaliek.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated SSRF in Kolibri RemoteFacilityUserViewset: Analysis and Impact

More from this source