Summary
Plane's OAuth avatar synchronization flow can make server-side HTTP requests to attacker-controlled avatar URLs without validating internal destinations. If the URL redirects to an internal service, the response may be fetched and exposed as an accessible avatar asset, potentially allowing disclosure of sensitive internal resources.
Plane's OAuth avatar synchronization flow can make server-side HTTP requests to attacker-controlled avatar URLs without validating internal destinations. If the URL redirects to an internal service, the response may be fetched and exposed as an accessible avatar asset, potentially allowing disclosure of sensitive internal resources.
Affected context
The vulnerability occurs in Plane deployments that synchronize user avatars through OAuth provider data and trust the provider-supplied avatar_url. Risk increases when the server follows redirects and does not enforce controls preventing requests to loopback, private, link-local, or other internal network destinations. Fetched content is then stored as an avatar asset that may be retrievable through the application's asset endpoint.
The vulnerability occurs in Plane deployments that synchronize user avatars through OAuth provider data and trust the provider-supplied avatar_url. Risk increases when the server follows redirects and does not enforce controls preventing requests to loopback, private, link-local, or other internal network destinations. Fetched content is then stored as an avatar asset that may be retrievable through the application's asset endpoint.
Exploit preconditions
- Attack surface: OAuth avatar synchronization and server-side avatar fetching
- Required access: Ability to influence or cause processing of an OAuth user profile containing an attacker-controlled avatar URL
- Trigger point: Server-side retrieval of the avatar URL during synchronization
- Why exploitation is possible: The fetcher does not adequately validate internal destinations and follows redirects, allowing an external URL to lead the server toward an internal resource whose response is stored and exposed as an asset
- Attack surface: OAuth avatar synchronization and server-side avatar fetching
- Required access: Ability to influence or cause processing of an OAuth user profile containing an attacker-controlled avatar URL
- Trigger point: Server-side retrieval of the avatar URL during synchronization
- Why exploitation is possible: The fetcher does not adequately validate internal destinations and follows redirects, allowing an external URL to lead the server toward an internal resource whose response is stored and exposed as an asset
Why this happens
The underlying issue is insufficient destination validation for server-side HTTP requests. An application accepts a URL from externally influenced provider data, follows redirects, and retrieves the resulting resource without reliably checking whether the final destination belongs to an internal or otherwise restricted network range. This behavior maps to CWE-918: Server-Side Request Forgery, where an attacker can cause a trusted server to access resources that should not be reachable through the public application.
The underlying issue is insufficient destination validation for server-side HTTP requests. An application accepts a URL from externally influenced provider data, follows redirects, and retrieves the resulting resource without reliably checking whether the final destination belongs to an internal or otherwise restricted network range. This behavior maps to CWE-918: Server-Side Request Forgery, where an attacker can cause a trusted server to access resources that should not be reachable through the public application.
Potential impact
- Sensitive metadata or internal service responses may be disclosed
- Internal network reconnaissance may be possible
- Cloud credentials or configuration data could be exposed if reachable through an internal endpoint
- Retrieved content may be persisted and made available through an application asset URL
- Internal services could receive unintended requests from the Plane server
- Sensitive metadata or internal service responses may be disclosed
- Internal network reconnaissance may be possible
- Cloud credentials or configuration data could be exposed if reachable through an internal endpoint
- Retrieved content may be persisted and made available through an application asset URL
- Internal services could receive unintended requests from the Plane server
General mitigation guidance
Mitigation generally focuses on treating externally supplied URLs as untrusted and enforcing destination restrictions before every server-side request.
Common defensive patterns include:
- Allowing only approved URL schemes, hostnames, and content types
- Resolving hostnames and rejecting loopback, private, link-local, multicast, and other restricted address ranges
- Revalidating the destination after DNS resolution and across redirects
- Disabling redirects by default or limiting them to validated destinations
- Applying egress network policies that restrict application access to internal services
- Avoiding persistence or public exposure of fetched content unless it is independently validated
- Running the fetcher with least-privilege network and filesystem permissions
Mitigation generally focuses on treating externally supplied URLs as untrusted and enforcing destination restrictions before every server-side request.
Common defensive patterns include:
- Allowing only approved URL schemes, hostnames, and content types
- Resolving hostnames and rejecting loopback, private, link-local, multicast, and other restricted address ranges
- Revalidating the destination after DNS resolution and across redirects
- Disabling redirects by default or limiting them to validated destinations
- Applying egress network policies that restrict application access to internal services
- Avoiding persistence or public exposure of fetched content unless it is independently validated
- Running the fetcher with least-privilege network and filesystem permissions
How teams detect issues like this
Detection can combine application review, runtime monitoring, and network controls:
- Use static analysis to identify HTTP clients consuming user-controlled or provider-controlled URLs
- Review code for missing private-range checks, unrestricted redirects, and URL validation performed only before DNS resolution
- Monitor outbound requests from the application to loopback, private, link-local, metadata, and unusual ports
- Audit asset creation events and correlate them with OAuth synchronization activity
- Enforce egress policies that alert on or block access to restricted network ranges
- Use automated security review tools to flag SSRF-prone request flows and unsafe URL handling
Detection can combine application review, runtime monitoring, and network controls:
- Use static analysis to identify HTTP clients consuming user-controlled or provider-controlled URLs
- Review code for missing private-range checks, unrestricted redirects, and URL validation performed only before DNS resolution
- Monitor outbound requests from the application to loopback, private, link-local, metadata, and unusual ports
- Audit asset creation events and correlate them with OAuth synchronization activity
- Enforce egress policies that alert on or block access to restricted network ranges
- Use automated security review tools to flag SSRF-prone request flows and unsafe URL handling
