Summary
A DNS rebinding flaw in Apache Fesod's UrlImageConverter can bypass SSRF protections when an application accepts attacker-controlled image URLs for spreadsheet generation. If the attacker controls DNS responses, the hostname may resolve to an allowed address during validation and to a restricted internal address when the converter opens a separate connection.
A DNS rebinding flaw in Apache Fesod's UrlImageConverter can bypass SSRF protections when an application accepts attacker-controlled image URLs for spreadsheet generation. If the attacker controls DNS responses, the hostname may resolve to an allowed address during validation and to a restricted internal address when the converter opens a separate connection.
Affected context
The issue occurs in applications using the UrlImageConverter with remote URL image fetching enabled. It becomes risky when user-controlled image URLs are accepted, hostname validation and resource retrieval perform separate DNS resolutions, and the attacker can influence DNS responses for the requested hostname.
The issue occurs in applications using the UrlImageConverter with remote URL image fetching enabled. It becomes risky when user-controlled image URLs are accepted, hostname validation and resource retrieval perform separate DNS resolutions, and the attacker can influence DNS responses for the requested hostname.
Exploit preconditions
- Attack surface: Remote image URL handling in the spreadsheet-writing component
- Required access: Ability to submit or influence an image URL processed by the application
- Trigger point: URL validation followed by the converter's outbound image request
- Why exploitation is possible: DNS rebinding can cause validation and retrieval to resolve the same hostname to different IP addresses, allowing a permitted resolution to be replaced with a restricted destination
- Attack surface: Remote image URL handling in the spreadsheet-writing component
- Required access: Ability to submit or influence an image URL processed by the application
- Trigger point: URL validation followed by the converter's outbound image request
- Why exploitation is possible: DNS rebinding can cause validation and retrieval to resolve the same hostname to different IP addresses, allowing a permitted resolution to be replaced with a restricted destination
Why this happens
The protection validates resolved addresses before opening a separate network connection, but the later connection can perform a fresh DNS lookup.
This time-of-check/time-of-use gap allows attacker-controlled DNS behavior to change the destination between validation and retrieval. The behavior maps to CWE-918: Server-Side Request Forgery, because the server can be induced to make requests to destinations that should not be reachable through the user-facing feature.
The protection validates resolved addresses before opening a separate network connection, but the later connection can perform a fresh DNS lookup.
This time-of-check/time-of-use gap allows attacker-controlled DNS behavior to change the destination between validation and retrieval. The behavior maps to CWE-918: Server-Side Request Forgery, because the server can be induced to make requests to destinations that should not be reachable through the user-facing feature.
Potential impact
- The application may connect to internal or otherwise restricted services
- Cloud metadata or service credentials could be exposed
- Internal APIs may receive attacker-controlled requests
- Network segmentation controls could be bypassed
- Sensitive response data may be incorporated into application processing
- The application may connect to internal or otherwise restricted services
- Cloud metadata or service credentials could be exposed
- Internal APIs may receive attacker-controlled requests
- Network segmentation controls could be bypassed
- Sensitive response data may be incorporated into application processing
General mitigation guidance
Mitigation typically focuses on disabling remote URL fetching unless it is required and reducing trust in user-supplied destinations.
Common defensive patterns include:
- Use local or pre-approved image sources instead of arbitrary remote URLs
- Require an explicit exact-host allowlist when remote fetching is enabled
- Resolve and validate destinations consistently with the connection that performs retrieval
- Recheck resolved addresses and reject private, loopback, link-local, multicast, and other restricted ranges
- Restrict outbound network access from the processing service through egress policies
- Avoid following redirects to destinations outside the approved host and address policy
- Run the converter with only the network and filesystem privileges it needs
Mitigation typically focuses on disabling remote URL fetching unless it is required and reducing trust in user-supplied destinations.
Common defensive patterns include:
- Use local or pre-approved image sources instead of arbitrary remote URLs
- Require an explicit exact-host allowlist when remote fetching is enabled
- Resolve and validate destinations consistently with the connection that performs retrieval
- Recheck resolved addresses and reject private, loopback, link-local, multicast, and other restricted ranges
- Restrict outbound network access from the processing service through egress policies
- Avoid following redirects to destinations outside the approved host and address policy
- Run the converter with only the network and filesystem privileges it needs
How teams detect issues like this
Organizations commonly detect SSRF and DNS rebinding risks through:
- Static analysis rules for user-controlled URLs passed to HTTP clients
- Code review checks for separate DNS validation and connection steps
- Tests using changing DNS answers, redirects, and private-address resolution
- Monitoring outbound requests from spreadsheet-processing services to internal address ranges
- Egress policy alerts for access to metadata endpoints, loopback addresses, and private network segments
- Automated security review tools that flag missing URL allowlists and weak destination validation
Organizations commonly detect SSRF and DNS rebinding risks through:
- Static analysis rules for user-controlled URLs passed to HTTP clients
- Code review checks for separate DNS validation and connection steps
- Tests using changing DNS answers, redirects, and private-address resolution
- Monitoring outbound requests from spreadsheet-processing services to internal address ranges
- Egress policy alerts for access to metadata endpoints, loopback addresses, and private network segments
- Automated security review tools that flag missing URL allowlists and weak destination validation
Sources
| Source | Link |
|---|---|
| cve. | cve.org/ |
| github. | github.com/ |
| github. | github.com/ |
| lists. | lists.apache.org/ |
