Headline
GHSA-jqx4-9gpq-rppm: @misskey-dev/summaly allows IP Filter Bypass via Redirect
Summary
Due to a validation error in got.scpaping, it is possible to use an HTTP redirect to avoid IP filtering.
Details
In got.scpaping, Summaly first makes a HTTP HEAD request to the page being summarized. It then preforms private IP address checks on the HEAD response, then makes an additional HTTP GET request to the page being summarized. Unfortunately, since private IP address checks aren’t performed on the GET response, the GET response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.
PoC
With a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:
@summaly-bypass-head {
method HEAD
path /summaly-bypass
}
@summaly-bypass-get {
method GET
path /summaly-bypass
}
header @summaly-bypass-head Content-Type "text/html"
respond @summaly-bypass-head 200
redir @summaly-bypass-get http://127.0.0.1:3080/
Impact
Using this bypass, an attacker can probe a victims internal network for HTTP services that aren’t supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.
Summary
Due to a validation error in got.scpaping, it is possible to use an HTTP redirect to avoid IP filtering.
Details
In got.scpaping, Summaly first makes a HTTP HEAD request to the page being summarized. It then preforms private IP address checks on the HEAD response, then makes an additional HTTP GET request to the page being summarized. Unfortunately, since private IP address checks aren’t performed on the GET response, the GET response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.
PoC
With a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:
@summaly-bypass-head { method HEAD path /summaly-bypass } @summaly-bypass-get { method GET path /summaly-bypass } header @summaly-bypass-head Content-Type “text/html” respond @summaly-bypass-head 200 redir @summaly-bypass-get http://127.0.0.1:3080/
Impact
Using this bypass, an attacker can probe a victims internal network for HTTP services that aren’t supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.
References
- GHSA-jqx4-9gpq-rppm
- misskey-dev/summaly@dfe6451