Summary
Thumbor's ALLOWED_SOURCES hostname allowlist logic can be bypassed because plain strings are passed directly to re.match() without escaping dots, allowing similarly shaped hostnames to be treated as allowed.
Under deployments where ALLOWED_SOURCES is used to constrain where Thumbor may fetch images, an attacker can abuse this to reach unintended internal or external endpoints.
Affected context
This vulnerability appears in Thumbor instances that rely on the ALLOWED_SOURCES configuration to restrict where images can be fetched.
The issue manifests when operators specify hostnames or domain patterns in ALLOWED_SOURCES, and Thumbor uses re.match() with these values directly as regular expressions.
In such configurations, dots are treated as regex wildcards, so hostnames that differ at specific dot positions can still match the allowlist pattern in practice.
Exploit preconditions
- Attack surface: HTTP interface of Thumbor, where users provide image URLs or paths.
- Required access: Ability to supply or influence image source URLs processed by Thumbor (often unauthenticated or low-authenticated).
- Trigger point: Thumbor's hostname validation against ALLOWED_SOURCES using
re.match()before fetching the image. - Why exploitation is possible: ALLOWED_SOURCES entries are interpreted as raw regular expressions, causing dots and other characters to have regex semantics rather than literal hostname semantics. This allows crafted hostnames that look similar to allowed ones to pass the check and be fetched.
Why this happens
The underlying issue is a misuse of regular expressions for hostname allowlisting without proper escaping or clear distinction between patterns and literals.
ALLOWED_SOURCES entries are passed directly into re.match() as if they were literal hostnames, but in regex syntax a dot (.) means "any character," affecting how matches are evaluated.
This maps to CWE-918 (Server-Side Request Forgery), because the service trusts a flawed validation mechanism to control outbound requests, enabling attackers to redirect server-side fetches to unintended endpoints.
Potential impact
- Thumbor can be tricked into making HTTP requests to internal services that were not intended to be reachable.
- Attackers may be able to probe or exfiltrate data from internal HTTP endpoints accessible to Thumbor.
- SSRF may be chained to further compromise, such as interacting with cloud metadata services.
- Logging, monitoring, or billing systems may reflect unexpected outbound traffic originating from Thumbor.
General mitigation guidance
Effective mitigation focuses on treating hostnames as data, not as raw regular expressions, and on enforcing strong outbound request boundaries.
Recommended defensive patterns include:
- Normalizing and parsing hostnames using URL/host parsing utilities, then performing exact or well-defined suffix/prefix comparisons rather than regex matches.
- When pattern support is needed, using well-scoped matching (e.g., explicit domain suffix checks) and applying robust escaping so special characters do not gain unintended semantics.
- Constraining outgoing requests at the network layer (firewalls, service meshes, or egress policies) so that even if logical checks fail, requests to sensitive internal ranges are blocked.
- Running Thumbor with least-privilege network access, limiting reachable internal services and minimizing the blast radius of any SSRF.
How teams detect issues like this
Detection typically involves both code-level analysis and runtime monitoring:
- Static analysis and configuration review to identify uses of
re.match()or similar APIs where hostname or URL validation relies on unescaped patterns. - Code review practices that flag regex-based allowlists or blocklists for hostnames and encourage explicit parsing and comparison instead.
- Policy enforcement within CI/CD pipelines that disallow or warn on regex use in security-critical validation logic.
- Runtime monitoring for unusual outbound traffic patterns from Thumbor instances, such as unexpected internal IP ranges or metadata service access, which can indicate SSRF attempts.
