platform-server: Unicode Whitespace in URLs Enables SSRF Bypass & Fix

Vulnerability Key Information Summary Vulnerability Overview Type: Defect in handling Unicode whitespace characters during URL parsing (SSRF bypass risk) Problem Description: The function fails to normalize Unicode whitespace characters when parsing URLs. This allows an attacker to insert Unicode whitespace characters (e.g., ) into protocol-relative URLs to bypass validation logic that relies on ASCII whitespace characters, resulting in a security bypass. Remediation: In , avoid directly trimming with . Instead, align with the WHATWG URL standard to ensure Unicode whitespace characters are correctly identified and processed. Scope of Impact Affected Files: - (core fix) - (test updates) - (test updates) Affected Versions: v21.2.3 and earlier versions (pre-commit) Impact Scenarios: - Insertion of Unicode whitespace characters (e.g., ) into protocol-relative URLs (e.g., ) - Insertion of Unicode whitespace characters into relative path parsing (e.g., ) - Similar bypasses potentially existing in absolute URL parsing Fix Details Core Change: In , replace with URL parsing logic compliant with the WHATWG standard, ensuring Unicode whitespace characters are correctly identified. Test Coverage: - New test cases verifying handling of Unicode whitespace characters in protocol-relative URLs - New test cases verifying handling of Unicode whitespace characters in relative paths - New test cases verifying handling of Unicode whitespace characters in absolute URLs POC / Exploitation Code

Goal Reached Thanks to every supporter — we hit 100%!

platform-server: Unicode Whitespace in URLs Enables SSRF Bypass & Fix

More from this source