| शीर्षक | heshengtao super-agent-party 0.4.2-preview Server-Side Request Forgery (CWE-918) |
|---|
| विवरण | # Technical Details
An unauthenticated SSRF vulnerability exists in the `/extension_proxy` route in `server.py` of super-agent-party.
The `sanitize_proxy_url()` helper parses the user-controlled `url`, detects private/loopback destinations via `is_private_ip(parsed.hostname)`, but only logs a warning and still returns the URL. The `/extension_proxy` route handler then passes the returned URL directly into `httpx.AsyncClient.request()` without any post-sanitization rejection, allowing unauthenticated callers to reach loopback or private-network HTTP services and read the response body through the proxy response. This affects the newer upstream tag `v0.4.2-preview` in addition to earlier versions.
# Vulnerable Code
File: server.py (Lines 7408-7412)
Method: `sanitize_proxy_url()`
Why: Detects private IPs with `if is_private_ip(parsed.hostname)` but only emits `logger.warning(f"Internal access detected: {safe_url}")` and returns the attacker-controlled URL — no exception, no rejection.
File: server.py (Lines 7421-7423)
Method: `/extension_proxy` route handler
Why: Calls `target_url = sanitize_proxy_url(url)` and treats the returned value as safe input with no post-processing deny decision.
File: server.py (Lines 7456-7464)
Method: `/extension_proxy` route handler (network dispatch)
Why: Dispatches the validated-but-not-blocked private URL through `await client.request(method=method, url=target_url, headers=headers, content=body)`, enabling SSRF with response readback.
# Reproduction
1. Start the super-agent-party backend from repository code.
2. Start a loopback canary HTTP service on `127.0.0.1:<port>`.
3. Send `GET /extension_proxy?url=http://127.0.0.1:<canary_port>/secret` to the backend.
4. Observe HTTP 200 with the canary marker in the response body, confirming the backend fetched the loopback-only service.
5. Check server logs for `WARNING - Internal access detected: http://127.0.0.1:...` followed by `HTTP Request: GET http://127.0.0.1:... "HTTP/1.1 200 OK"`, confirming the audit-only guard.
6. Run the control with a benign public URL — confirm normal proxying works and the loopback canary remains untouched.
# Impact
- Any attacker able to reach `/extension_proxy` can coerce the backend into sending HTTP requests to localhost or private-network targets.
- Exposes internal admin panels, local service APIs, cloud metadata endpoints, and other trusted-only HTTP surfaces.
- Response readback makes this more severe than blind SSRF — the fetched content is directly relayed to the attacker. |
|---|
| स्रोत | ⚠️ https://gist.github.com/YLChen-007/571e1905e24e4168479d08bbce1052c4 |
|---|
| उपयोगकर्ता | Erichen-x (UID 99082) |
|---|
| सबमिशन | 18/06/2026 04:45 AM (2 महीनों पहले) |
|---|
| संयम | 05/08/2026 06:11 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 386262 [heshengtao super-agent-party तक 0.4.1 extension_proxy Route server.py sanitize_proxy_url अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|