إرسال #893367: Studio-Saelix sencho <= 0.94.1 Server-Side Request Forgery

SUMMARY

The POST /api/git-sources/browse endpoint in Sencho accepts a repo_url parameter but only validates the URL scheme (requiring https://). It applies no restriction to the host or IP address. This allows an authenticated attacker to make the Sencho backend connect to arbitrary internal hosts, loopback addresses, or RFC1918 ranges, as long as the scheme is HTTPS.

DETAILS

By sending requests to various internal IPs and observing the response times and error messages, an attacker can reliably perform internal network reconnaissance and port scanning from inside the Sencho container. The endpoint returns distinguishably different responses depending on target state, which is sufficient to fingerprint open vs. closed vs. filtered ports and services on the internal network.

PROOF OF CONCEPT

curl -s -X POST -b cookies_admin.txt http://TARGET:1852/api/git-sources/browse \
-H "Content-Type: application/json" \
-d '{"repo_url":"https://127.0.0.1:9999/repo.git","branch":"main","auth_type":"none"}'

The endpoint returns distinguishably different errors for:
1. Closed ports -- "Connection refused by..." / NETWORK_TIMEOUT
2. Open ports lacking TLS -- "fetch failed" / GIT_ERROR
3. Filtered IPs -- hits timeout after ~10.4s

This three-way distinction is enough to reliably map the internal network topology (which hosts/ports are up, listening, and whether they speak TLS) purely from the Sencho backend's vantage point, without any direct network access of one's own.

IMPACT

Allows authenticated administrators (or any role permitted to reach this endpoint) to perform internal network and port reconnaissance from inside the Sencho container, potentially pivoting to other internal services or cloud metadata endpoints (x.x.x.x) reachable from that container's network position.

FIX

Apply the same host/IP validation that should protect the node-registration endpoint (see the companion advisory GHSA-49jj-vg9f-rg55 / VulDB submission for POST /api/nodes): resolve the host before validating, normalize all IP representations, block by IP range (loopback, link-local, RFC1918/RFC4193) rather than only checking the URL scheme, and re-validate the resolved address at actual connection time.

DUPLICATE CHECK

Checked VulDB, NVD, and the GitHub public Advisory Database prior to submission; no existing entry found. The vendor's own advisories page (github.com/Studio-Saelix/sencho/security/advisories) shows no published advisories as of this submission.

VENDOR CONTACT

Vendor contacted via a private GitHub Security Advisory (GHSA-hx8w-w8rp-2ppx) on Studio-Saelix/sencho. No CVE requested and no patch published by maintainers as of this submission.

• المصدر: ⚠️ https://gist.github.com/jovair1994/93446c14d30a16313e830490d71bbd1d
• المستخدم: jpazz (UID 99722)
• ارسال: 16/07/2026 10:22 PM (3 أشهر منذ)
• الاعتدال: 10/10/2026 02:48 PM (3 months later)
• الحالة: تمت الموافقة
• إدخال VulDB: 416189 [Studio-Saelix Sencho حتى 0.94.1 git-sources Browse API Endpoint outboundTarget.ts repo_url تجاوز الصلاحيات]
• النقاط: 20