| Titre | HKUDS nanobot 0.2.1 Server-Side Request Forgery (CWE-918) |
|---|
| Description | # Technical Details
A provider-response SSRF vulnerability exists in the `_download_image_data_url` method in `nanobot/providers/image_generation.py` of nanobot.
The application fails to validate provider-returned image URLs with the built-in `validate_url_target()` network guard before downloading `data[].url` values. A malicious or compromised configured image provider can therefore return a loopback or private-network URL, causing the nanobot host to fetch internal resources and persist the returned bytes as generated media.
# Vulnerable Code
File: nanobot/providers/image_generation.py
Method: _download_image_data_url()
Why: The function directly performs `client.get(url)` on provider-controlled URLs without applying SSRF target validation, even though the project already ships `nanobot/security/network.py` defenses for loopback and internal addresses.
# Reproduction
1. Configure nanobot 0.2.1 with an image provider that returns `{"data":[{"url":"http://127.0.0.1:<port>/internal.png"}]}` instead of inline `b64_json`.
2. Trigger `generate_image` through the normal `POST /v1/chat/completions` API path using the provided integration harness.
3. Observe that the canary loopback server is contacted and the saved generated image artifact contains the canary response bytes.
# Impact
- A malicious provider can force the nanobot host to issue HTTP requests to loopback, RFC1918, or metadata-adjacent targets reachable from the runtime.
- Internal service discovery and retrieval of attacker-shaped content become possible through the image-generation workflow. |
|---|
| La source | ⚠️ https://gist.github.com/YLChen-007/44bc77ac259e461c6938cc6c286c4430 |
|---|
| Utilisateur | Eric-c (UID 96848) |
|---|
| Soumission | 22/06/2026 04:16 (il y a 2 mois) |
|---|
| Modérer | 07/08/2026 14:08 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 387000 [HKUDS nanobot jusqu’à 0.2.1 Provider-returned Image URL image_generation.py _download_image_data_url élévation de privilèges] |
|---|
| Points | 20 |
|---|