SSRF Fix in Studio Video Download Endpoint via URL Whitelist

Vulnerability Fix Summary Vulnerability Overview Type: SSRF (Server-Side Request Forgery) Location: Studio video download endpoint ( ) Root Cause: This endpoint fetches the supplied by the client in and packages them into a ZIP for return. Because the URLs were not validated, an attacker could construct URLs pointing to internal services or metadata endpoints, thereby bypassing HTTP requests and expanding the SSRF attack surface. Impact Scope Affects the logic covered by ; previously, this endpoint lacked test coverage. Allows attackers to issue requests to internal resources via the field in . Fix Plan Core Strategy: Only allow fetching URLs that belong to the course's videos (i.e., URLs in that have already been exposed to the client). Any URL not belonging to this set is rejected. Implementation: - In , extract all valid URLs from to build a whitelist. - In , perform whitelist validation on each ; if a URL is not in the whitelist, raise a . Test Coverage: Added a test class covering the following: - Successful fetching and zipping of valid URLs; - Rejection of URLs not belonging to the course (returns 400 BAD_REQUEST); - When a mix of valid and invalid URLs is present, the invalid URL causes the request to be rejected; - Non-staff users cannot access (returns 403 FORBIDDEN). POC / Exploitation Code 1. Test Case: Valid URL Succeeds 2. Test Case: Invalid URL is Rejected 3. Test Case: Invalid URL is Rejected When URLs are Mixed 4. Test Case: Non-staff User is Denied 5. Core Fix Code: URL Whitelist Validation

Goal Reached Thanks to every supporter — we hit 100%!

SSRF Fix in Studio Video Download Endpoint via URL Whitelist

More from this source