Submit #865113: HKUDS nanobot 0.2.1 Server-Side Request Forgery (CWE-918)

# Technical Details
A provider-response SSRF vulnerability exists in the `_download_image_data_url` method in `nanobot/providers/image_generation.py` of nanobot.

The application fails to validate provider-returned image URLs with the built-in `validate_url_target()` network guard before downloading `data[].url` values. A malicious or compromised configured image provider can therefore return a loopback or private-network URL, causing the nanobot host to fetch internal resources and persist the returned bytes as generated media.

# Vulnerable Code
File: nanobot/providers/image_generation.py
Method: _download_image_data_url()
Why: The function directly performs `client.get(url)` on provider-controlled URLs without applying SSRF target validation, even though the project already ships `nanobot/security/network.py` defenses for loopback and internal addresses.

# Reproduction
1. Configure nanobot 0.2.1 with an image provider that returns `{"data":[{"url":"http://127.0.0.1:<port>/internal.png"}]}` instead of inline `b64_json`.
2. Trigger `generate_image` through the normal `POST /v1/chat/completions` API path using the provided integration harness.
3. Observe that the canary loopback server is contacted and the saved generated image artifact contains the canary response bytes.

# Impact
- A malicious provider can force the nanobot host to issue HTTP requests to loopback, RFC1918, or metadata-adjacent targets reachable from the runtime.
- Internal service discovery and retrieval of attacker-shaped content become possible through the image-generation workflow.

• Quelle: ⚠️ https://gist.github.com/YLChen-007/44bc77ac259e461c6938cc6c286c4430
• Benutzer: Eric-c (UID 96848)
• Einreichung: 22.06.2026 04:16 (vor 2 Monaten)
• Moderieren: 07.08.2026 14:08 (2 months later)
• Status: Akzeptiert
• VulDB Eintrag: 387000 [HKUDS nanobot bis 0.2.1 Provider-returned Image URL image_generation.py _download_image_data_url erweiterte Rechte]
• Punkte: 20