Skip to content

SSRF: /v2/validate (by URL) fetches arbitrary URLs with no private-range/metadata guard #4

Description

@themightychris

Problem

POST /v2/validate fetches the GTFS ZIP from a caller-supplied url server-side. ValidationService.validateFromUrl validates only that the scheme is http/https — there is no block on private/loopback/link-local ranges or the cloud metadata endpoint (169.254.169.254). On any deployment with public ingress this is a server-side request forgery (SSRF) vector: the service becomes a fetch primitive against the deployment's internal network and instance metadata.

Proposal

  • After DNS resolution, reject targets in loopback / private (RFC 1918) / link-local / unique-local ranges and the metadata IP, guarding against DNS-rebinding (re-check the resolved address actually used for the connection), and/or
  • A config flag to disable the by-URL endpoint entirely for deployments that only need validate-upload.

Happy to contribute. Context: surfaced while test-driving #1 for a publicly-reachable deployment that only uses validate-upload.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions