Repository navigation
Conversation
…nder-scoped page calls A connection a person adds could point at any host, the runtime's own network and the cloud's instance metadata service among them, because allowed_hosts lets every host through until an operator sets it. Every host check now refuses loopback, private, link-local, shared, reserved and multicast addresses, IPv6 addresses that embed one, single-label names and the internal suffixes, however the URL writes them, unless the new connections.private_hosts setting lists the host. The check is the one hostRefusalOf, so it holds when a connection is added, when it is first used and on every outbound call and redirect. The headers that open a cloud's instance metadata service (Metadata, Metadata-Flavor, X-Google-Metadata-Request, X-AWS-EC2-Metadata-Token, X-AWS-EC2-Metadata-Token-TTL-Seconds) are reserved for every tool server type, in entry headers and credential header names alike. The connection page operations (read_link, approve, give_credential and consent start/finish) were permitted by any one permission, so a playbook:read token of the person who added a connection could approve it. They now take the derived permission: org:read for read_link, org:write for the commands, as add_connection does.
Contributor
|
I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const bitsInIpv6 = 128n; | ||
|
|
||
| function writtenHostOf(host: string): string { | ||
| const lowered = host.toLowerCase().replace(/\.+$/u, ''); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes three pentest findings: SSRF-VULN-01, SSRF-VULN-02 (medium, CWE-918) and BFLA on connection page operations (medium, CWE-863).
SSRF-VULN-01: private destinations refused by default
namesAPrivateHost(packages/operations/src/addresses/private-hosts.ts), with hosts read the way a URL parser reads them (canonical-hosts.ts). It refuses:169.254/16,fe80::/10), unique-local, reserved, multicast and broadcast addresses;metadata, and names under.localhost,.local,.internaland similar suffixes, plusmetadata.azure.com.hostRefusalOfapplies this beforeallowed_hosts. It is the one check point, so it holds when a connection is added, at first use and on every outbound call and redirect.namesTheLoopbacknow covers every loopback form.connections.private_hosts, empty by default. A host listed there must still passallowed_hostswhen that is set.Breaking for operators: a connection to a private host, e.g. a local MCP server, now needs
private_hosts: [localhost]. Tool servers configured inauto-runtime.yamlare not affected. Existing connections to private hosts will be refused after restart until the host is listed.Not covered: DNS rebinding.
fetchnever exposes the address it resolved to. The docs now recommend blocking the metadata service at the network level.SSRF-VULN-02: metadata headers reserved
Metadata,Metadata-Flavor,X-Google-Metadata-Request,X-AWS-EC2-Metadata-TokenandX-AWS-EC2-Metadata-Token-TTL-Secondsare now reserved for both MCP and OpenAPI tool servers. This applies to entry headers and to credential header names.Authorizationis deliberately not reserved. Operator tool servers set it inheaders, and connection credentials go in through it.BFLA: page operations take the derived permission
read_link,approve,give_credentialand consentstart/finishno longer accept any one permission (allPermissions).read_linknow needsorg:read. The commands needorg:write, matchingadd_connection.org:read,playbook:readandplaybook:writetokens are refused for these commands.Docs
docs/self-host/connections.md,docs/self-host/configuration.md,docs/reference/http.md, the OpenAPI document andauto-runtime.schema.jsonare updated.Checks
pnpm checkpasses: format, lint, typecheck, tests with 100% coverage, knip and sherif.Related PRs (same pentest)