SSRF guard re-resolves DNS at connect time, so rebinding is still possible

Đã đóng
  • Có gì không ổn?
#515 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 4 ngày

@sparkysolutions10-pixel đang làm issue này rồi.

Từ ngày 19/10/2026.

  • #578 của @sparkysolutions10-pixel — đang mở

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
node.js, typescript
Lĩnh vực
backend, networking, security

Hướng nghiên cứu

Start with src/net/ssrf.ts and trace how its lookup, fetchImpl, and redirect handling work; then read the existing tests that exercise those injectable dependencies. Run those tests before making changes. Done means the connected address is one that was validated, TLS verification and redirect checks remain intact, the injections still work, a rebinding test passes, and the module comment accurately states the guarantee.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

area:security help wanted

Follow-up to #407, which was closed by #488. That PR is a thorough guard and removed the whole easy attack surface — this is the residue it deliberately left.

Not a Wave issue right now. The repo's Wave budget for this round is exhausted, so this is filed for tracking rather than for points. It will be labelled for the Wave when the next round opens.

The gap

src/net/ssrf.ts validates and then fetches:

let url = await assertUrlSafe(target, opts)
const response = await fetchImpl(url.toString(), { ...init, redirect: 'manual' })

assertUrlSafe resolves the hostname and checks every returned address. fetchImpl is then given the hostname, and Node resolves it again when it opens the connection.

An attacker who controls a DNS zone can serve a short-TTL record that answers the first query with a public address and the second with 169.254.169.254. The check passes, the connection goes somewhere else. This is DNS rebinding, and it is the specific thing a post-resolution check is otherwise meant to defeat.

It matters here because the MCP server takes its target URL from an agent, and agents routinely read attacker-influenced text.

What to build

Pin the connection to an address that was actually validated.

  • An undici dispatcher with a custom connect or lookup is the usual route: resolve once, validate, and hand the chosen address to the connector so no second resolution happens.
  • Or connect by IP with the Host header preserved — be careful, this breaks TLS SNI and certificate verification unless servername is set explicitly, so it is not the simpler option it appears to be.
  • Re-validate on every redirect hop, as the current code already does.
  • The existing injectable lookup and fetchImpl should stay injectable, because that is what makes the current tests possible.
Also

Correct the module comment. It currently reads:

to decide that after resolving the hostname, because a public-looking name can resolve to a private address — the classic way this check is bypassed.

True of a static name, not of an attacker-controlled one. Say plainly that connect-time resolution is not yet pinned, so nobody reads it as a guarantee it does not make.

Acceptance criteria
  • The address connected to is one that was validated
  • A test proves a hostname resolving differently on the second lookup does not reach the second address
  • TLS verification still works against the original hostname
  • Redirect hops remain validated
  • lookup and fetchImpl stay injectable and the existing tests still pass
  • The module comment states what is and is not guaranteed
Ngôn ngữ chính
TypeScript
Star
4
Fork
71
Merge trung bình
3 ngày 22 giờ
Pull request đã merge (30 ngày)
142

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của Divinity-Labs/Lens

Tất cả issue của Divinity-Labs/Lens

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.