🛡️ Sentinel: Fix SSRF via Redirects in WebsiteAnalysisService - #385
🛡️ Sentinel: Fix SSRF via Redirects in WebsiteAnalysisService#385criptogus wants to merge 1 commit into
Conversation
🚨 Severity: HIGH 💡 Vulnerability: SSRF via Redirects The `WebsiteAnalysisService` used `axios` with default redirect handling (`maxRedirects: 5`). While the initial URL was validated against private IPs, a malicious server could redirect the request to a private IP (e.g., `http://localhost/admin`), bypassing the initial check. 🎯 Impact: An attacker could access internal services (like the database REST interface or cloud metadata services) by providing a URL that redirects to them. 🔧 Fix: - Disabled automatic redirects in `axios` (`maxRedirects: 0`). - Implemented a manual loop to follow redirects (up to 5). - Added `validateWebUrl(currentUrl)` check at EACH step of the redirect chain. - This ensures that every URL fetched is validated against the SSRF filter. ✅ Verification: - Added `backend/src/tests/services/websiteAnalysisService.test.ts` which simulates a redirect to a private IP and asserts that it is blocked. - Ran tests successfully with `npm test`. Co-authored-by: criptogus <128640021+criptogus@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
Fixed SSRF vulnerability in WebsiteAnalysisService by implementing manual redirect handling and validation. Added unit tests to verify the fix.
PR created automatically by Jules for task 2172533208198083493 started by @criptogus