| عنوان | bitcoinj <=0.17 SSRF |
|---|
| الوصف | PaymentSession fetches a BIP-70 PaymentRequest from a remote party and later issues an HTTP POST to the URL contained in that message's payment_details.payment_url field.
That URL is attacker-controlled data taken straight off the wire. It is passed to new URL(...) and then url.openConnection() with no scheme allowlist, no host validation, and no private/loopback/link-local address filtering.
The protocol's PKI layer does not mitigate this, for two independent reasons:
The pki_type field is chosen by the sender of the message. Setting pki_type = "none" makes verifyPaymentRequestPki() return null immediately — the entire certificate chain check is skipped. No certificate is required.
Even with a valid x509+sha256 signature, the signature covers serialized_payment_details; it attests who authored the message, not where the URL points. Any party holding any valid certificate can sign a request whose payment_url targets 127.0.0.1.
The victim wallet reaches the vulnerable path while using verifyPki = true, the most secure client configuration available.
|
|---|
| المصدر | ⚠️ https://github.com/bitcoinj/bitcoinj/issues/4386 |
|---|
| المستخدم | ZAST.AI (UID 87884) |
|---|
| ارسال | 29/09/2026 09:14 AM (18 أيام منذ) |
|---|
| الاعتدال | 15/10/2026 08:08 PM (16 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 420761 [bitcoinj حتى 0.17 Payment Request PaymentSession.java url.openConnection pki_type تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|