| Título | heshengtao super-agent-party 0.4.1 Server-Side Request Forgery (CWE-918) |
|---|
| Descripción | # Technical Details
An unauthenticated SSRF vulnerability exists in the `/extension_proxy` route handler in `server.py` of super-agent-party.
The backend exposes a public `/extension_proxy` route that accepts an attacker-controlled `url` parameter and performs a server-side HTTP request via `httpx.AsyncClient.request()`. The `sanitize_proxy_url()` helper correctly detects private-network destinations via `is_private_ip(parsed.hostname)`, but only emits a warning log instead of rejecting the request. The function then returns the attacker-controlled URL unchanged, allowing the route to proceed with the private-network request and relay the response body back to the attacker.
# Vulnerable Code
File: server.py (Lines 7265-7294)
Method: `sanitize_proxy_url()`
Why: The helper detects private/internal IP destinations but only logs via `logger.warning(f"Internal access detected: {safe_url}")` and still returns the URL — there is no deny decision or exception raised.
File: server.py (Lines 7296-7375)
Method: `/extension_proxy` route handler
Why: The route calls `target_url = sanitize_proxy_url(url)`, then unconditionally passes the result into `await client.request(method=method, url=target_url, headers=headers, content=body)`, returning the upstream response to the caller without any post-sanitization block.
# Reproduction
1. Deploy super-agent-party v0.4.1 via the official Docker image `ailm32442/super-agent-party:latest`.
2. Set up a second container on the same private Docker network running a canary HTTP service.
3. Send `GET /extension_proxy?url=http://sap-ssrf-target:5678/secret?token=SAP_SSRF_CANARY` to the backend.
4. Observe HTTP 200 with the canary response body `SAP_SSRF_CANARY` returned, confirming the backend reached the private-network service.
5. Run the control with a public URL like `https://example.com/` — confirm normal proxying works and the canary is untouched.
6. Check the server logs for the warning `Internal access detected: http://sap-ssrf-target:...` followed by the actual HTTP request, proving the log-and-continue behavior.
# Impact
- Any network client that can reach the backend can probe and read HTTP services from the backend's network context.
- Exposes container-internal services, loopback-bound admin panels, metadata endpoints, and other internal APIs.
- The route relays the fetched response body back to the attacker, making this a direct data exfiltration primitive rather than blind SSRF. |
|---|
| Fuente | ⚠️ https://gist.github.com/YLChen-007/2f12ffb785d975b46b73896c0fb8cb5d |
|---|
| Usuario | Erichen-x (UID 99082) |
|---|
| Sumisión | 2026-06-18 04:44 (hace 2 meses) |
|---|
| Moderación | 2026-08-05 18:10 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 386262 [heshengtao super-agent-party hasta 0.4.1 extension_proxy Route server.py sanitize_proxy_url escalada de privilegios] |
|---|
| Puntos | 20 |
|---|