OpenViking SSRF in HTTP Resource Ingestion: Fix Details and POC

Vulnerability Overview This vulnerability involves a Server-Side Request Forgery (SSRF) issue during HTTP resource ingestion. Attackers can exploit OpenViking's HTTP resource ingestion functionality to access internal network resources by constructing malicious URLs, leading to sensitive information leakage. Affected Scope Affected Versions: All versions of OpenViking using the HTTP resource ingestion functionality prior to the patch. Attack Conditions: Requires authentication privileges. Attackers can craft specific URL requests to access internal network resources via the HTTP resource ingestion function. Potential Risks: Unauthorized access to internal network resources and leakage of sensitive information. Remediation Plan 1. Add Network Guard: Introduce target host resolution, DNS resolution checks, rejection of non-public addresses, and reusable HTTP request hooks in . 2. Enforce Public Target Validation: Enforce public target validation in and to ensure the security of server-side resource ingestion. 3. Add Remote Target Validation: Add remote target validation in to re-validate remote resources, inject request validators into parser parameters, and retain boolean flags for re-processing based on monitoring. 4. Threading Request Validator: Thread the request validator in to ensure consistency in URL detection, HTML fetching, downloading, redirection, and proxy inheritance. 5. Update Resource Processor: Update the resource processor in to re-raise framework security errors instead of downgrading them to parsing warnings. 6. Add Regression Tests: Add regression tests in to ensure failure scenarios for loopback HTTP targets, private Gopher targets, and parser-level enforcement. POC Code Verification Run commands such as to verify the fix. Local dynamic verification showed that before the fix, HEAD and GET requests could be sent to the loopback-only HTTP server, and unique response tokens could be retrieved. After the fix, the same loopback target was blocked with during pre-check, URL detection, fetching, and retrieval, and the loopback server did not receive any requests. Future Hardening Extend the same transport-layer validation to non- repository fetchers, such as GitHub ZIP download paths and git clone, to provide equivalent redirection and proxy protection for repository ingestion. Consider implementing connection-time IP penalties if stronger DNS rebinding resistance is desired between validation and connection. If controlled internal network ingestion is a legitimate product requirement, the gateway should be placed behind an explicit administrator allowlist rather than implicitly accessing the private network. Code Review : Introduces target host resolution, DNS resolution checks, rejection of non-public addresses, and reusable HTTP request hooks. and : Enforce public target validation to ensure the security of server-side resource ingestion. : Adds remote target validation, re-validates remote resources, injects request validators into parser parameters, and retains boolean flags for re-processing based on monitoring. : Threads the request validator to ensure consistency in URL detection, HTML fetching, downloading, redirection, and proxy inheritance. : Updates the resource processor to re-raise framework security errors instead of downgrading them to parsing warnings. : Adds regression tests to ensure failure scenarios for loopback HTTP targets, private Gopher targets, and parser-level enforcement.

Goal Reached Thanks to every supporter — we hit 100%!

OpenViking SSRF in HTTP Resource Ingestion: Fix Details and POC

More from this source