提交 #862456: heshengtao super-agent-party 0.4.1 Server-Side Request Forgery (CWE-918)

# Technical Details
An unauthenticated SSRF vulnerability exists in the `/extension_proxy` route handler in `server.py` of super-agent-party.

The backend exposes a public `/extension_proxy` route that accepts an attacker-controlled `url` parameter and performs a server-side HTTP request via `httpx.AsyncClient.request()`. The `sanitize_proxy_url()` helper correctly detects private-network destinations via `is_private_ip(parsed.hostname)`, but only emits a warning log instead of rejecting the request. The function then returns the attacker-controlled URL unchanged, allowing the route to proceed with the private-network request and relay the response body back to the attacker.

# Vulnerable Code
File: server.py (Lines 7265-7294)
Method: `sanitize_proxy_url()`
Why: The helper detects private/internal IP destinations but only logs via `logger.warning(f"Internal access detected: {safe_url}")` and still returns the URL — there is no deny decision or exception raised.

File: server.py (Lines 7296-7375)
Method: `/extension_proxy` route handler
Why: The route calls `target_url = sanitize_proxy_url(url)`, then unconditionally passes the result into `await client.request(method=method, url=target_url, headers=headers, content=body)`, returning the upstream response to the caller without any post-sanitization block.

# Reproduction
1. Deploy super-agent-party v0.4.1 via the official Docker image `ailm32442/super-agent-party:latest`.
2. Set up a second container on the same private Docker network running a canary HTTP service.
3. Send `GET /extension_proxy?url=http://sap-ssrf-target:5678/secret?token=SAP_SSRF_CANARY` to the backend.
4. Observe HTTP 200 with the canary response body `SAP_SSRF_CANARY` returned, confirming the backend reached the private-network service.
5. Run the control with a public URL like `https://example.com/` — confirm normal proxying works and the canary is untouched.
6. Check the server logs for the warning `Internal access detected: http://sap-ssrf-target:...` followed by the actual HTTP request, proving the log-and-continue behavior.

# Impact
- Any network client that can reach the backend can probe and read HTTP services from the backend's network context.
- Exposes container-internal services, loopback-bound admin panels, metadata endpoints, and other internal APIs.
- The route relays the fetched response body back to the attacker, making this a direct data exfiltration primitive rather than blind SSRF.

• 来源: ⚠️ https://gist.github.com/YLChen-007/2f12ffb785d975b46b73896c0fb8cb5d
• 用户: Erichen-x (UID 99082)
• 提交: 2026-06-18 04時44分 (2 月前)
• 管理: 2026-08-05 18時10分 (2 months later)
• 状态: 已接受
• VulDB条目: 386262 [heshengtao super-agent-party 直到 0.4.1 extension_proxy Route server.py sanitize_proxy_url 权限提升]
• 积分: 20