Summary
Finsys Dockhand contains a server-side request forgery vulnerability that allows authenticated users to cause the server to retrieve arbitrary URLs. The fetched response may be returned through the compose response field, potentially exposing internal service data, cloud metadata, credentials, and access tokens.
Finsys Dockhand contains a server-side request forgery vulnerability that allows authenticated users to cause the server to retrieve arbitrary URLs. The fetched response may be returned through the compose response field, potentially exposing internal service data, cloud metadata, credentials, and access tokens.
Affected context
The issue affects Dockhand deployments where authenticated users can supply repository URL and stackfile values that influence server-side fetching. Risk is higher when the Dockhand server can reach internal services, cloud metadata endpoints, administrative interfaces, or other network locations that are not directly accessible to the user.
The issue affects Dockhand deployments where authenticated users can supply repository URL and stackfile values that influence server-side fetching. Risk is higher when the Dockhand server can reach internal services, cloud metadata endpoints, administrative interfaces, or other network locations that are not directly accessible to the user.
Exploit preconditions
- Attack surface: Server-side repository and stack template retrieval
- Required access: A valid authenticated Dockhand account with permission to submit or manage relevant stack configuration
- Trigger point: Processing of user-controlled repository URL or stackfile values
- Why exploitation is possible: The server retrieves attacker-influenced URLs and exposes fetched content through the compose response field without sufficiently restricting destinations or response disclosure
- Attack surface: Server-side repository and stack template retrieval
- Required access: A valid authenticated Dockhand account with permission to submit or manage relevant stack configuration
- Trigger point: Processing of user-controlled repository URL or stackfile values
- Why exploitation is possible: The server retrieves attacker-influenced URLs and exposes fetched content through the compose response field without sufficiently restricting destinations or response disclosure
Why this happens
The vulnerability results from treating user-controlled URL and stackfile references as trusted server-side fetch instructions.
The application performs outbound requests without adequately enforcing destination restrictions, network boundaries, or response handling rules. Returning fetched content to the requesting user creates a response-disclosing SSRF condition, mapping to CWE-918: Server-Side Request Forgery.
The vulnerability results from treating user-controlled URL and stackfile references as trusted server-side fetch instructions.
The application performs outbound requests without adequately enforcing destination restrictions, network boundaries, or response handling rules. Returning fetched content to the requesting user creates a response-disclosing SSRF condition, mapping to CWE-918: Server-Side Request Forgery.
Potential impact
- Internal service responses may be disclosed
- Cloud instance metadata, credentials, or tokens could be exposed
- Internal administrative endpoints may be queried
- Network segmentation controls may be bypassed from the server's location
- Retrieved secrets could enable further unauthorized access
- Internal service responses may be disclosed
- Cloud instance metadata, credentials, or tokens could be exposed
- Internal administrative endpoints may be queried
- Network segmentation controls may be bypassed from the server's location
- Retrieved secrets could enable further unauthorized access
General mitigation guidance
Mitigation generally focuses on reducing trust in user-controlled URLs and preventing the application from acting as an unrestricted network proxy.
Common defensive patterns include:
- Allowing only approved schemes, hosts, ports, and repository destinations
- Applying destination allowlists rather than broad URL acceptance
- Blocking loopback, link-local, private, reserved, and cloud metadata address ranges
- Revalidating resolved addresses to reduce DNS rebinding and redirect bypasses
- Disabling or tightly controlling redirects and response-body disclosure
- Running outbound fetch operations with restricted network egress and least privilege
- Separating repository retrieval from sensitive internal networks
- Validating stack configuration against strict schemas before processing
Mitigation generally focuses on reducing trust in user-controlled URLs and preventing the application from acting as an unrestricted network proxy.
Common defensive patterns include:
- Allowing only approved schemes, hosts, ports, and repository destinations
- Applying destination allowlists rather than broad URL acceptance
- Blocking loopback, link-local, private, reserved, and cloud metadata address ranges
- Revalidating resolved addresses to reduce DNS rebinding and redirect bypasses
- Disabling or tightly controlling redirects and response-body disclosure
- Running outbound fetch operations with restricted network egress and least privilege
- Separating repository retrieval from sensitive internal networks
- Validating stack configuration against strict schemas before processing
How teams detect issues like this
Organizations can identify SSRF risks through:
- Static analysis rules for server-side HTTP clients receiving user-controlled URLs
- Code review checks for missing URL, hostname, redirect, and destination validation
- Monitoring outbound requests from Dockhand processes to private, loopback, link-local, and metadata addresses
- Network egress policies that restrict application servers to approved destinations
- Logging and alerting on unusual repository targets, response sizes, and repeated internal address probes
- Automated security review tools that flag user-influenced URL fetches and response reflection
Organizations can identify SSRF risks through:
- Static analysis rules for server-side HTTP clients receiving user-controlled URLs
- Code review checks for missing URL, hostname, redirect, and destination validation
- Monitoring outbound requests from Dockhand processes to private, loopback, link-local, and metadata addresses
- Network egress policies that restrict application servers to approved destinations
- Logging and alerting on unusual repository targets, response sizes, and repeated internal address probes
- Automated security review tools that flag user-influenced URL fetches and response reflection
