| Title | heshengtao super-agent-party 0.4.2-preview Server-Side Request Forgery (CWE-918) |
|---|
| Description | # Technical Details
An unauthenticated SSRF vulnerability exists in the `/extension_proxy` route in `server.py` of super-agent-party.
The `sanitize_proxy_url()` helper parses the user-controlled `url`, detects private/loopback destinations via `is_private_ip(parsed.hostname)`, but only logs a warning and still returns the URL. The `/extension_proxy` route handler then passes the returned URL directly into `httpx.AsyncClient.request()` without any post-sanitization rejection, allowing unauthenticated callers to reach loopback or private-network HTTP services and read the response body through the proxy response. This affects the newer upstream tag `v0.4.2-preview` in addition to earlier versions.
# Vulnerable Code
File: server.py (Lines 7408-7412)
Method: `sanitize_proxy_url()`
Why: Detects private IPs with `if is_private_ip(parsed.hostname)` but only emits `logger.warning(f"Internal access detected: {safe_url}")` and returns the attacker-controlled URL — no exception, no rejection.
File: server.py (Lines 7421-7423)
Method: `/extension_proxy` route handler
Why: Calls `target_url = sanitize_proxy_url(url)` and treats the returned value as safe input with no post-processing deny decision.
File: server.py (Lines 7456-7464)
Method: `/extension_proxy` route handler (network dispatch)
Why: Dispatches the validated-but-not-blocked private URL through `await client.request(method=method, url=target_url, headers=headers, content=body)`, enabling SSRF with response readback.
# Reproduction
1. Start the super-agent-party backend from repository code.
2. Start a loopback canary HTTP service on `127.0.0.1:<port>`.
3. Send `GET /extension_proxy?url=http://127.0.0.1:<canary_port>/secret` to the backend.
4. Observe HTTP 200 with the canary marker in the response body, confirming the backend fetched the loopback-only service.
5. Check server logs for `WARNING - Internal access detected: http://127.0.0.1:...` followed by `HTTP Request: GET http://127.0.0.1:... "HTTP/1.1 200 OK"`, confirming the audit-only guard.
6. Run the control with a benign public URL — confirm normal proxying works and the loopback canary remains untouched.
# Impact
- Any attacker able to reach `/extension_proxy` can coerce the backend into sending HTTP requests to localhost or private-network targets.
- Exposes internal admin panels, local service APIs, cloud metadata endpoints, and other trusted-only HTTP surfaces.
- Response readback makes this more severe than blind SSRF — the fetched content is directly relayed to the attacker. |
|---|
| Source | ⚠️ https://gist.github.com/YLChen-007/571e1905e24e4168479d08bbce1052c4 |
|---|
| User | Erichen-x (UID 99082) |
|---|
| Submission | 06/18/2026 04:45 (2 months ago) |
|---|
| Moderation | 08/05/2026 18:11 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 386262 [heshengtao super-agent-party up to 0.4.1 extension_proxy Route server.py sanitize_proxy_url server-side request forgery] |
|---|
| Points | 0 |
|---|