| Title | heshengtao super-agent-party 0.4.1 Server-Side Request Forgery (CWE-918) |
|---|
| Description | # Technical Details
A Server-Side Request Forgery via `extension_proxy` exists in the `sanitize_proxy_url()` function and the `/extension_proxy` route handler in `server.py` of super-agent-party.
The application fails to reject private-network and loopback destinations after detecting them. The `sanitize_proxy_url()` helper correctly calls `is_private_ip(parsed.hostname)` but only emits a warning log when the hostname resolves to a private or loopback address, then returns the attacker-controlled URL unchanged. The route handler then forwards this URL into `httpx.AsyncClient.request()`, allowing the backend to fetch internal HTTP resources and relay their response bodies to the attacker.
# Vulnerable Code
File: server.py
Method: sanitize_proxy_url() — detects private destinations via is_private_ip() but only logs "Internal access detected" and returns safe_url; /extension_proxy route — accepts attacker-supplied url, passes it through sanitize_proxy_url(), and dispatches to httpx.AsyncClient.request()
Why: The private-network detection branch is audit-only — it logs but never rejects. The returned safe_url is then trusted by the downstream HTTP client, completing the SSRF chain.
# Reproduction
1. Deploy super-agent-party v0.4.1 via Docker Compose with a private-network canary service.
2. Send `GET /extension_proxy?url=http://sap-ssrf-target:5678/secret?token=SAP_SSRF_CANARY`.
3. Observe HTTP 200 response body containing the canary token from the internal service.
4. Confirm the control request to a public URL returns ordinary public content without hitting the canary.
# Impact
- Unauthenticated SSRF with full response disclosure — attacker can probe and read HTTP services reachable from the backend's network context.
- Exposes container-internal services, loopback-bound admin panels, metadata endpoints, cloud metadata services, and other internal APIs.
- The route relays the fetched response body back to the attacker, making this a direct data exfiltration primitive rather than blind SSRF. |
|---|
| Source | ⚠️ https://gist.github.com/YLChen-007/2f12ffb785d975b46b73896c0fb8cb5d |
|---|
| User | JohnChen (UID 99088) |
|---|
| Submission | 06/18/2026 09:01 (2 months ago) |
|---|
| Moderation | 08/05/2026 20:56 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 386262 [heshengtao super-agent-party up to 0.4.1 extension_proxy Route server.py sanitize_proxy_url server-side request forgery] |
|---|
| Points | 0 |
|---|