Jina Reader Self-Hosted SSRF: Bypass Internal IP Check via Domain Resolution

Vulnerability Summary: Server-Side Request Forgery (SSRF) Due to Domain Resolution Bypass in Self-Hosted Deployments Vulnerability Overview Vulnerability Type: Server-Side Request Forgery (SSRF) Root Cause: The SSRI protection mechanism in the service is defective in self-hosted deployments. 1. In self-hosted mode, defaults to , and the environment variable is not set. 2. The second line of defense in the code (Guard 2) relies on the flag. When this flag is , the service uses to resolve domain names. 3. The critical flaw is that returns the resolved IP address, but when the code checks , due to a JavaScript operator precedence issue ( has higher precedence than ), there is a vulnerability in the logic for checking . 4. An attacker can use a public domain name that resolves to a private IP address (such as ), bypassing hostname-based checks and causing the service to issue requests to that private address. Scope of Impact Affected Versions: The version (based on in the screenshot and the Docker image ). Affected Environments: Self-hosted deployments. Security Impact: - Unauthenticated attackers can leverage this service as a proxy to issue requests to any host reachable within the server’s network. - In cloud infrastructure (such as AWS, GCP, Azure), attackers can access instance metadata (including IAM credentials), thereby gaining full account takeover privileges. - In self-hosted deployments, attackers can reconnoiter and extract data from internal services (such as Kubernetes API servers, databases, and management interfaces). - The service is unauthenticated, and this vulnerability can be exploited without a user account or API key. Remediation Temporary Mitigation: - In self-hosted deployments, set the environment variable to enable , thereby enabling the acceptance of private IP addresses. - Alternatively, configure network policies to restrict the service to access only specific external domains, blocking direct access to private IP addresses. Fundamental Fix: - Fix the IP check logic following in the code to ensure the correctly determined whether the resolved IP falls within a non-public range. - In the method, add a strict check for the resolved IP to ensure all resolved IPs are validated before an HTTP request is issued. POC Code Prerequisites A instance running with the official Docker image, using default configuration (the environment variable is not set, and is not set). HTTP/1.1 listening on port 8081 (inside the container, mapped to 9701 in the example). A private network service reachable from the reader container (in cloud deployments, this is the instance metadata service, such as , or other services within the VPC). Step 1: Start the Service with Default Configuration Step 2: Verify That Direct RFC1918 IPs Are Blocked (Expected Behavior) Step 3: Use a Domain Resolving to a Private Address (Bypassing the Guard) Expected Response (HTTP 200): Cloud Metadata (AWS IMDSv1) Step 4: The Same Attack Also Applies to GET Requests with the URL Embedded in the Path

Goal Reached Thanks to every supporter — we hit 100%!

Jina Reader Self-Hosted SSRF: Bypass Internal IP Check via Domain Resolution

More from this source