Summary
NVIDIA Dynamo for Linux contains a server-side request forgery vulnerability in its Rust multimodal media fetcher. If attacker-controlled media locations are processed, an attacker may cause the server to send requests to unintended destinations and potentially disclose information.
Affected context
The vulnerability occurs in deployments that use NVIDIA Dynamo's Rust multimodal media fetcher to retrieve media from locations influenced by external or insufficiently trusted input. Risk depends on whether the fetcher can reach internal services, protected network resources, or endpoints containing sensitive information.
Exploit preconditions
- Attack surface: The multimodal media-fetching functionality exposed by the server
- Required access: Ability to submit or influence a media reference processed by the fetcher
- Trigger point: Server-side retrieval of the attacker-influenced location
- Why exploitation is possible: The fetcher may make outbound requests without adequately restricting destination schemes, hosts, addresses, or network paths
Why this happens
The underlying issue is insufficient validation and destination control for server-side network requests. When a service retrieves a resource based on attacker-influenced input without enforcing an allowlist and blocking private or reserved destinations, it can be induced to access resources from the server's network position. This behavior maps to CWE-918: Server-Side Request Forgery.
Potential impact
- An attacker may retrieve information from internal services
- Sensitive response data could be disclosed through the application
- Cloud or infrastructure metadata may be exposed where reachable
- Internal network topology and service availability could be revealed
General mitigation guidance
Mitigation generally focuses on reducing trust in externally supplied media locations and constraining outbound requests.
Common defensive patterns include:
- Permit retrieval only from an explicit allowlist of schemes, hosts, and ports
- Reject loopback, link-local, private, multicast, and otherwise reserved address ranges
- Resolve hostnames and validate the resulting addresses before connecting
- Revalidate destinations across redirects and disable redirects where they are unnecessary
- Apply outbound network egress controls and isolate the fetcher from sensitive network segments
- Limit response size, request duration, and returned content to the minimum required
- Run the fetcher with least-privilege network and runtime permissions
How teams detect issues like this
Detection approaches commonly include:
- Static analysis for network clients consuming URLs or destinations derived from request data
- Code review checks for missing scheme, hostname, port, redirect, and IP-range validation
- Tests covering loopback, private, link-local, encoded, redirected, and DNS-rebinding destinations
- Network monitoring for unexpected outbound connections from the media-fetching service
- Egress policies that alert on or block access to internal and metadata endpoints
- Automated security review tools that identify SSRF-prone request flows
