Webhook/Link OAuth-avatar SSRF fix: IP validation bypass, DNS rebinding, and redirect handling

Vulnerability Overview This vulnerability involves multiple Server-Side Request Forgery (SSRF) issues, primarily affecting the , , and functionalities. Specifically: 1. Cluster A - Private IP Validation and PATCH Bypass - Issue: passed , but was always , causing the guard to be ineffective. - Fix: Hardcoded IP classification ( ), supporting formats such as , , , and . Additionally, fixed parsing issues for IPv6 addresses including , , and . 2. Cluster B - DNS Rebinding TOCTOU (Unpatched Core) - Issue: The resolver performed DNS lookups upon connection, allowing attackers to swap internal IPs between two DNS lookups. - Fix: Utilized from to use the validated IP literal upon connection, avoiding secondary DNS lookups. 3. Cluster C - SSRF in HTTP Redirections - Issue: did not automatically disable redirects. Manual re-parsing and re-validation of each caused relative headers to resolve to logical hostname URLs rather than IP literal URLs. - Fix: Disabled redirects and ensured that relative headers for each resolve to logical hostname URLs. Impact Scope Cluster A: Affects requests to , potentially leading to private IP validation bypasses. Cluster B: Affects DNS rebinding attacks on and , potentially allowing exploitation of internal IPs. Cluster C: Affects HTTP redirections in , potentially enabling SSRF attacks. Remediation Steps 1. Cluster A - Implement hardcoded IP classification supporting various IPv6 formats. - Fix parsing issues for IPv6 addresses such as , , and . 2. Cluster B - Use from to avoid secondary DNS lookups. 3. Cluster C - Disable redirects and ensure relative headers for each resolve to logical hostname URLs. Test Scenarios Webhook to a public endpoint: Verify that /TLS/certificate validation is applied correctly. Webhook whose URL resolves to an internal/blocked IP: Verify that internal/blocked IPs are rejected. DNS-rebinding: Verify that DNS rebinding attacks are blocked. Webhook PATCH updating the URL: Verify that requests correctly use the validated IP. Work-item link unfurl to a public URL: Verify that redirect loops are blocked. References Advisory clusters A / B / C: Relevant CVE and GHSA links. Cluster B GHSA: Relevant GHSA link. Cluster C GHSA: Relevant GHSA link. Summary The fix addresses multiple SSRF vulnerabilities by implementing hardcoded IP classifications, avoiding secondary DNS lookups, and disabling redirects, thereby ensuring the security of , , and functionalities.

Goal Reached Thanks to every supporter — we hit 100%!

Webhook/Link OAuth-avatar SSRF fix: IP validation bypass, DNS rebinding, and redirect handling

More from this source