Summary
Serveral Server-Side Request Forgery (SSRF) vulnerability in the /get route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network.
Details
The URL from user input is checked to be not local:
|
if (await isLocalResource(urlObj)) { |
|
throw new LocalResourceError(); |
|
} |
|
|
|
const response = await axios.get(remoteUrl); |
|
export default async function isLocalResource(url: URL): Promise<boolean> { |
|
// Resolve domain name |
|
const addr = (await dns.promises.lookup(url.hostname)).address; |
|
|
|
// Check if IP is in local network |
|
return ipRangeCheck(addr, subnets); |
|
} |
But it only checks the first DNS resolution result, not subsequent HTTP redirections or later changed DNS resolution results. So it's still possible to send requests to local addresses.
PoC
302 redirect to localhost:8080: https://txt.artegoser.ru/get?url=http://6f7iwg44.requestrepo.com
DNS rebinding: https://txt.dc09.ru/get?url=http://rebinding.6f7iwg44.requestrepo.com:8080 (need to try multiple times before success)
Impact
Remote attackers can retrieve information in the internal network.
Patch
Version 1.7.0 prevents displaying the response of forged requests, but the requests can still be sent. For complete mitigation, a firewall between txtdot and other internal network resources should be set.
Summary
Serveral Server-Side Request Forgery (SSRF) vulnerability in the
/getroute of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network.Details
The URL from user input is checked to be not local:
txtdot/src/handlers/distributor.ts
Lines 43 to 47 in a7fdaf8
txtdot/src/utils/islocal.ts
Lines 38 to 44 in a7fdaf8
But it only checks the first DNS resolution result, not subsequent HTTP redirections or later changed DNS resolution results. So it's still possible to send requests to local addresses.
PoC
302 redirect to
localhost:8080: https://txt.artegoser.ru/get?url=http://6f7iwg44.requestrepo.comDNS rebinding: https://txt.dc09.ru/get?url=http://rebinding.6f7iwg44.requestrepo.com:8080 (need to try multiple times before success)
Impact
Remote attackers can retrieve information in the internal network.
Patch
Version 1.7.0 prevents displaying the response of forged requests, but the requests can still be sent. For complete mitigation, a firewall between txtdot and other internal network resources should be set.