Hi Lissy93,
I found a security issue in the lookup feature (used by the hosted instance at bug-bounties.as93.net and available to self-hosters): a server-side request forgery via unvalidated redirect following.
The input hostname is validated against private IP ranges, but every fetch source (security-txt.ts, http-headers.ts, common-pages.ts, util.ts safeFetch) follows redirects without re-validating the target - a 302 can point the server at any internal address, and parts of the response get reflected back.
I confirmed this with a controlled proof of concept (no internal data accessed): the origin followed my redirect, and internal-address targets produced the expected timing differential (~+5s per-source timeout).
Per SECURITY.md I tried security@as93.net first but the mail was rejected by the rspamd filter, and private vulnerability reporting isn't enabled for this repo. I'd rather not dump the full exploit details in a public issue - could you point me to a private channel, or enable private vulnerability reporting so I can file a draft advisory?
Happy to share the full report (root cause, PoC log, suggested fix) privately.
Thanks for the project - the private-IP blocking and timeouts are a good base; only the redirect handling needs hardening.
Best regards,
0xsanihsan
Hi Lissy93,
I found a security issue in the lookup feature (used by the hosted instance at bug-bounties.as93.net and available to self-hosters): a server-side request forgery via unvalidated redirect following.
The input hostname is validated against private IP ranges, but every fetch source (security-txt.ts, http-headers.ts, common-pages.ts, util.ts safeFetch) follows redirects without re-validating the target - a 302 can point the server at any internal address, and parts of the response get reflected back.
I confirmed this with a controlled proof of concept (no internal data accessed): the origin followed my redirect, and internal-address targets produced the expected timing differential (~+5s per-source timeout).
Per SECURITY.md I tried security@as93.net first but the mail was rejected by the rspamd filter, and private vulnerability reporting isn't enabled for this repo. I'd rather not dump the full exploit details in a public issue - could you point me to a private channel, or enable private vulnerability reporting so I can file a draft advisory?
Happy to share the full report (root cause, PoC log, suggested fix) privately.
Thanks for the project - the private-IP blocking and timeouts are a good base; only the redirect handling needs hardening.
Best regards,
0xsanihsan