SSRF vulnerability in PartKeeper

[asesidaa]

Bug description

Since there is no security policy and I cannot find contact information to the developers, I have to use issue to report this.

There is an SSRF vulnerability in PartKeeper. The add attatchment through URL function does not have any restriction on the URL.

Steps to reproduce

1. Go to Edit part->attatchments
2. Add attatchments through URL
3. Use file:///etc/passwd as URL
4. Observe local file on server being loaded
5. If on demo site, use http://169.254.169.254 as URL
6. Observe the matadata being retrieved

Suggestion

Check this link for more information on SSRF
Check this link for more information on how to fix this. Basically you would need to make sure only http and https URLs are accepted, and requests to non public ip addresses are blocked.

System Information

• PartKeepr Version: Latest commit

[matmair]

Considering #1059 you will probably not get a response or official recognition.

[Core2DuoKing]

Considering #1059 you will probably not get a response or official recognition.

Which is terrible. The PartKeepr demo online looks like it was incredibly well thought out and works nicely, I guess just keeping it air-gapped and using it as-is might be sufficient for some. But dang, for a free self-hosted open source inventory management software, it's surprisingly good.