Chat-master chat-server Unauthenticated SSRF and Sender Spoofing Vulnerability Analysis

Chat-master CVE Vulnerability Report Summary Vulnerability Overview Vulnerability Type: Unauthenticated SSRF (Server-Side Request Forgery) + Unauthenticated Sender Spoofing Severity: High (CVSS v3.1: 8.6 High) Vulnerability Description: The module of the Chat-master project contains two severe unauthenticated vulnerabilities: 1. Unauthenticated SSRF: Attackers can establish a raw TCP connection via TCP port 9000 and send a TASK type message containing any URL. The server executes an outbound HTTP GET request and returns the complete response to the attacker. 2. Message Sender Spoofing: Attackers can send BROADCAST or NORMAL type messages, forge arbitrary sender identities, and send messages to all connected clients. Root Cause: Lack of session authentication controls Unconditional trust in the sender identity provided by the client No validation of URLs in TASK messages No restrictions on outbound HTTP requests Impact Scope Affected Component: Affected Version: 1.0-SNAPSHOT Impact: Attackers can use SSRF to access internal network services and cloud metadata services (AWS, Azure, GCP). Sensitive information can be read (internal APIs, databases, configuration files). Forged messages can be sent to all users, enabling social engineering attacks. Internal network topology can be probed. Attack Vector: Remote unauthenticated network attack Via TCP port 9000 No credentials, user interaction, or privileged access required Remediation Recommended Fixes 1. Implement Session Authentication - Establish a persistent server-side session mapping after the LOGIN message. - Reject all unauthenticated TASK, BROADCAST, NORMAL, and LOGOUT messages. 2. Eliminate Trust in Client-Provided Sender Headers - Derive message sender identities solely from server-authenticated sessions. 3. Enforce URL Validation - Implement strict URL/URL pattern allowlists, blocklists, IP ranges, port restrictions, and redirect limits. - Resolve all target hostnames to detect private or loopback addresses. 4. Restrict Outbound HTTP Request Handling - Fix connection timeouts, read timeouts, and maximum response sizes. - Enforce restrictions on expected Content MIME types. 5. Deploy Network Isolation - Place the server in a restricted network segment. - Restrict access to internal sensitive services or cloud metadata endpoints. Temporary Mitigations Limit exposure of TCP port 9000 via firewalls, security groups, or network ACLs. Permanently disable or remove the FileTaskHandler code path. Deploy network isolation policies. POC Code SSRF POC Description: This confirms that a fully unauthenticated TCP client can force the chat server to send an HTTP GET request to any local address and receive the complete response body. Sender Spoofing POC Description: All connected clients receive a private message attributed to user1, even though the original socket never completed the login authentication process. Validation Environment Used outdated dependency versions and build configurations. Created a local vulnerability verification copy. Only modified the build compatibility layer. All vulnerability business logic code remained unchanged. All POC tests were restricted to to prevent unauthorized cross-network requests. Related CWEs CWE-918: Server-Side Request Forgery CWE-306: Missing Authentication for Critical Function CWE-290: Authentication Bypass by Spoofing

Goal Reached Thanks to every supporter — we hit 100%!

Chat-master chat-server Unauthenticated SSRF and Sender Spoofing Vulnerability Analysis

More from this source