| 标题 | heshengtao super-agent-party 0.4.2-preview Server-Side Request Forgery (CWE-918) |
|---|
| 描述 | # Technical Details
An Unauthenticated SSRF via `/extension_proxy` Allowing Loopback and Private Network Access exists in the `sanitize_proxy_url()` function and the `/extension_proxy` route handler in `server.py` of super-agent-party.
The application fails to reject private-network and loopback destinations after detecting them. The `sanitize_proxy_url()` helper correctly calls `is_private_ip(parsed.hostname)` but only emits a warning log when the hostname resolves to a private or loopback address, then returns the attacker-controlled URL unchanged. The route handler builds headers from user input and forwards the target URL into `httpx.AsyncClient.request()`. The endpoint is unauthenticated, allowing any remote attacker who can reach the backend HTTP service to coerce it into fetching internal HTTP resources and relaying their response bodies.
# Vulnerable Code
File: server.py
Method: sanitize_proxy_url() — detects private destinations via is_private_ip() but only emits logger.warning("Internal access detected") and returns safe_url; /extension_proxy route — accepts attacker-controlled url, builds request with user-supplied method/headers/body, and dispatches via httpx.AsyncClient.request()
Why: The private-network detection is audit-only with no deny decision. The returned safe_url passes directly into the HTTP client. No authentication is required on the endpoint.
# Reproduction
1. Start the backend: `server.py --host 127.0.0.1 --port <port>`.
2. Start a loopback canary HTTP server on `127.0.0.1`.
3. Send `GET /extension_proxy?url=http://127.0.0.1:<canary_port>/secret`.
4. Observe HTTP 200 response containing the canary marker, with server log showing "Internal access detected" warning.
5. Confirm the control request to a benign public URL returns ordinary content without hitting the canary.
# Impact
- Unauthenticated SSRF with full response disclosure affecting any reachable internal HTTP service.
- Exposes internal admin panels, local service APIs, cloud metadata endpoints, and other trusted-only HTTP surfaces.
- Response body is relayed to the attacker, making this more severe than blind SSRF and enabling direct data exfiltration. |
|---|
| 来源 | ⚠️ https://gist.github.com/YLChen-007/571e1905e24e4168479d08bbce1052c4 |
|---|
| 用户 | ChenMarry (UID 99089) |
|---|
| 提交 | 2026-06-18 09時29分 (2 月前) |
|---|
| 管理 | 2026-08-05 20時56分 (2 months later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 386262 [heshengtao super-agent-party 直到 0.4.1 extension_proxy Route server.py sanitize_proxy_url 权限提升] |
|---|
| 积分 | 0 |
|---|