提出 #865113: HKUDS nanobot 0.2.1 Server-Side Request Forgery (CWE-918)

# Technical Details
A provider-response SSRF vulnerability exists in the `_download_image_data_url` method in `nanobot/providers/image_generation.py` of nanobot.

The application fails to validate provider-returned image URLs with the built-in `validate_url_target()` network guard before downloading `data[].url` values. A malicious or compromised configured image provider can therefore return a loopback or private-network URL, causing the nanobot host to fetch internal resources and persist the returned bytes as generated media.

# Vulnerable Code
File: nanobot/providers/image_generation.py
Method: _download_image_data_url()
Why: The function directly performs `client.get(url)` on provider-controlled URLs without applying SSRF target validation, even though the project already ships `nanobot/security/network.py` defenses for loopback and internal addresses.

# Reproduction
1. Configure nanobot 0.2.1 with an image provider that returns `{"data":[{"url":"http://127.0.0.1:<port>/internal.png"}]}` instead of inline `b64_json`.
2. Trigger `generate_image` through the normal `POST /v1/chat/completions` API path using the provided integration harness.
3. Observe that the canary loopback server is contacted and the saved generated image artifact contains the canary response bytes.

# Impact
- A malicious provider can force the nanobot host to issue HTTP requests to loopback, RFC1918, or metadata-adjacent targets reachable from the runtime.
- Internal service discovery and retrieval of attacker-shaped content become possible through the image-generation workflow.

• ソース: ⚠️ https://gist.github.com/YLChen-007/44bc77ac259e461c6938cc6c286c4430
• ユーザー: Eric-c (UID 96848)
• 送信: 2026年06月22日 04:16 (2 月 ago)
• モデレーション: 2026年08月07日 14:08 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 387000 [HKUDS nanobot 迄 0.2.1 Provider-returned Image URL image_generation.py _download_image_data_url 特権昇格]
• ポイント: 20