| Title | Studio-Saelix sencho <= 0.94.1 Server-Side Request Forgery |
|---|
| Description | SUMMARY
The POST /api/git-sources/browse endpoint in Sencho accepts a repo_url parameter but only validates the URL scheme (requiring https://). It applies no restriction to the host or IP address. This allows an authenticated attacker to make the Sencho backend connect to arbitrary internal hosts, loopback addresses, or RFC1918 ranges, as long as the scheme is HTTPS.
DETAILS
By sending requests to various internal IPs and observing the response times and error messages, an attacker can reliably perform internal network reconnaissance and port scanning from inside the Sencho container. The endpoint returns distinguishably different responses depending on target state, which is sufficient to fingerprint open vs. closed vs. filtered ports and services on the internal network.
PROOF OF CONCEPT
curl -s -X POST -b cookies_admin.txt http://TARGET:1852/api/git-sources/browse \
-H "Content-Type: application/json" \
-d '{"repo_url":"https://127.0.0.1:9999/repo.git","branch":"main","auth_type":"none"}'
The endpoint returns distinguishably different errors for:
1. Closed ports -- "Connection refused by..." / NETWORK_TIMEOUT
2. Open ports lacking TLS -- "fetch failed" / GIT_ERROR
3. Filtered IPs -- hits timeout after ~10.4s
This three-way distinction is enough to reliably map the internal network topology (which hosts/ports are up, listening, and whether they speak TLS) purely from the Sencho backend's vantage point, without any direct network access of one's own.
IMPACT
Allows authenticated administrators (or any role permitted to reach this endpoint) to perform internal network and port reconnaissance from inside the Sencho container, potentially pivoting to other internal services or cloud metadata endpoints (x.x.x.x) reachable from that container's network position.
FIX
Apply the same host/IP validation that should protect the node-registration endpoint (see the companion advisory GHSA-49jj-vg9f-rg55 / VulDB submission for POST /api/nodes): resolve the host before validating, normalize all IP representations, block by IP range (loopback, link-local, RFC1918/RFC4193) rather than only checking the URL scheme, and re-validate the resolved address at actual connection time.
DUPLICATE CHECK
Checked VulDB, NVD, and the GitHub public Advisory Database prior to submission; no existing entry found. The vendor's own advisories page (github.com/Studio-Saelix/sencho/security/advisories) shows no published advisories as of this submission.
VENDOR CONTACT
Vendor contacted via a private GitHub Security Advisory (GHSA-hx8w-w8rp-2ppx) on Studio-Saelix/sencho. No CVE requested and no patch published by maintainers as of this submission. |
|---|
| Source | ⚠️ https://gist.github.com/jovair1994/93446c14d30a16313e830490d71bbd1d |
|---|
| User | jpazz (UID 99722) |
|---|
| Submission | 07/16/2026 22:22 (3 months ago) |
|---|
| Moderation | 10/10/2026 14:48 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416189 [Studio-Saelix Sencho up to 0.94.1 git-sources Browse API Endpoint outboundTarget.ts repo_url server-side request forgery] |
|---|
| Points | 20 |
|---|