| शीर्षक | heshengtao super-agent-party 0.4.1 Server-Side Request Forgery (CWE-918) |
|---|
| विवरण | # Technical Details
An unauthenticated SSRF vulnerability exists in the `/extension_proxy` route handler in `server.py` of super-agent-party.
The backend exposes a public `/extension_proxy` route that accepts an attacker-controlled `url` parameter and performs a server-side HTTP request via `httpx.AsyncClient.request()`. The `sanitize_proxy_url()` helper correctly detects private-network destinations via `is_private_ip(parsed.hostname)`, but only emits a warning log instead of rejecting the request. The function then returns the attacker-controlled URL unchanged, allowing the route to proceed with the private-network request and relay the response body back to the attacker.
# Vulnerable Code
File: server.py (Lines 7265-7294)
Method: `sanitize_proxy_url()`
Why: The helper detects private/internal IP destinations but only logs via `logger.warning(f"Internal access detected: {safe_url}")` and still returns the URL — there is no deny decision or exception raised.
File: server.py (Lines 7296-7375)
Method: `/extension_proxy` route handler
Why: The route calls `target_url = sanitize_proxy_url(url)`, then unconditionally passes the result into `await client.request(method=method, url=target_url, headers=headers, content=body)`, returning the upstream response to the caller without any post-sanitization block.
# Reproduction
1. Deploy super-agent-party v0.4.1 via the official Docker image `ailm32442/super-agent-party:latest`.
2. Set up a second container on the same private Docker network running a canary HTTP service.
3. Send `GET /extension_proxy?url=http://sap-ssrf-target:5678/secret?token=SAP_SSRF_CANARY` to the backend.
4. Observe HTTP 200 with the canary response body `SAP_SSRF_CANARY` returned, confirming the backend reached the private-network service.
5. Run the control with a public URL like `https://example.com/` — confirm normal proxying works and the canary is untouched.
6. Check the server logs for the warning `Internal access detected: http://sap-ssrf-target:...` followed by the actual HTTP request, proving the log-and-continue behavior.
# Impact
- Any network client that can reach the backend can probe and read HTTP services from the backend's network context.
- Exposes container-internal services, loopback-bound admin panels, metadata endpoints, and other internal APIs.
- The route relays the fetched response body back to the attacker, making this a direct data exfiltration primitive rather than blind SSRF. |
|---|
| स्रोत | ⚠️ https://gist.github.com/YLChen-007/2f12ffb785d975b46b73896c0fb8cb5d |
|---|
| उपयोगकर्ता | Erichen-x (UID 99082) |
|---|
| सबमिशन | 18/06/2026 04:44 AM (2 महीनों पहले) |
|---|
| संयम | 05/08/2026 06:10 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 386262 [heshengtao super-agent-party तक 0.4.1 extension_proxy Route server.py sanitize_proxy_url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|