Summary
Flyto2 Core's HTTP automation modules can be abused to perform server-side request forgery when they follow redirects without revalidating each hop's destination.
Under these conditions, an attacker controlling a public URL can pivot requests into internal network addresses and capture sensitive response bodies.
Flyto2 Core's HTTP automation modules can be abused to perform server-side request forgery when they follow redirects without revalidating each hop's destination.
Under these conditions, an attacker controlling a public URL can pivot requests into internal network addresses and capture sensitive response bodies.
Affected context
This vulnerability occurs in Flyto2 Core workflows that:
- Use the HTTP modules
http.get,http.request, orhttp.batch - Allow user-controlled or externally sourced URLs to be passed into these modules
- Follow HTTP redirects (
allow_redirects=True) without enforcing strict per-hop URL policies
In such scenarios, an attacker-controlled public endpoint can issue a redirect to internal hosts (e.g., http://127.0.0.1 or RFC1918 ranges), causing Flyto2 Core to access those internal resources and return their response data to the attacker-controlled workflow.
This vulnerability occurs in Flyto2 Core workflows that:
- Use the HTTP modules
http.get,http.request, orhttp.batch - Allow user-controlled or externally sourced URLs to be passed into these modules
- Follow HTTP redirects (
allow_redirects=True) without enforcing strict per-hop URL policies
In such scenarios, an attacker-controlled public endpoint can issue a redirect to internal hosts (e.g., http://127.0.0.1 or RFC1918 ranges), causing Flyto2 Core to access those internal resources and return their response data to the attacker-controlled workflow.
Exploit preconditions
- Attack surface: HTTP automation modules (
http.get,http.request,http.batch) reachable via workflows, agents, or automation scripts. - Required access: Ability to influence the initial request URL or configure workflows that call the HTTP modules (e.g., providing task inputs, prompts, or configuration values).
- Trigger point: Execution of an HTTP call that follows redirects from a public URL to an internal address, with
allow_redirects=True. - Why exploitation is possible: The implementation validates only the initial URL and then trusts subsequent redirect targets without rechecking whether each Location header stays within allowed domains or excludes internal IP ranges, enabling SSRF into internal networks and services.
- Attack surface: HTTP automation modules (
http.get,http.request,http.batch) reachable via workflows, agents, or automation scripts. - Required access: Ability to influence the initial request URL or configure workflows that call the HTTP modules (e.g., providing task inputs, prompts, or configuration values).
- Trigger point: Execution of an HTTP call that follows redirects from a public URL to an internal address, with
allow_redirects=True. - Why exploitation is possible: The implementation validates only the initial URL and then trusts subsequent redirect targets without rechecking whether each Location header stays within allowed domains or excludes internal IP ranges, enabling SSRF into internal networks and services.
Why this happens
The root cause is insufficient enforcement of URL validation on a per-redirect-hop basis within the HTTP modules.
The code performs an initial safety check on the starting URL but then enables automatic redirect following (allow_redirects=True) without re-validating each Location header against the same trust and network boundary rules.
This aligns with CWE-918: Server-Side Request Forgery (SSRF), where a server-side component makes HTTP requests based on attacker-controlled inputs and fails to constrain where those requests can be directed, allowing access to internal or otherwise restricted resources.
The root cause is insufficient enforcement of URL validation on a per-redirect-hop basis within the HTTP modules.
The code performs an initial safety check on the starting URL but then enables automatic redirect following (allow_redirects=True) without re-validating each Location header against the same trust and network boundary rules.
This aligns with CWE-918: Server-Side Request Forgery (SSRF), where a server-side component makes HTTP requests based on attacker-controlled inputs and fails to constrain where those requests can be directed, allowing access to internal or otherwise restricted resources.
Potential impact
- An attacker may read response bodies from internal HTTP services that are not directly exposed to the internet.
- Attackers could enumerate internal endpoints and service behavior by observing status codes, headers, and error messages.
- SSRF could be combined with other weaknesses to reach cloud metadata services and obtain credentials or configuration secrets.
- Internal administrative panels, monitoring endpoints, or local agent APIs might be accessed, enabling further compromise.
- Workflows and AI agents could be manipulated to exfiltrate sensitive environment data through their HTTP integrations.
- An attacker may read response bodies from internal HTTP services that are not directly exposed to the internet.
- Attackers could enumerate internal endpoints and service behavior by observing status codes, headers, and error messages.
- SSRF could be combined with other weaknesses to reach cloud metadata services and obtain credentials or configuration secrets.
- Internal administrative panels, monitoring endpoints, or local agent APIs might be accessed, enabling further compromise.
- Workflows and AI agents could be manipulated to exfiltrate sensitive environment data through their HTTP integrations.
General mitigation guidance
Effective mitigation patterns focus on constraining outbound HTTP destinations and enforcing robust redirect validation:
- Apply strict allowlists for domains or hosts that HTTP modules are permitted to contact; deny internal IP ranges and link-local addresses by default.
- Re-validate every redirect hop's Location header against the same policy used for the initial URL, rejecting redirects to disallowed hosts or schemes.
- Introduce network-layer egress controls (firewalls or proxy layers) to block requests to internal infrastructure and metadata services from automation runtimes.
- Separate high-privilege internal connectivity from general automation workloads, running HTTP-capable modules with least-privilege network access.
- Normalize and sanitize user-supplied URLs before use, and avoid treating arbitrary external URLs as trusted workflow inputs.
Effective mitigation patterns focus on constraining outbound HTTP destinations and enforcing robust redirect validation:
- Apply strict allowlists for domains or hosts that HTTP modules are permitted to contact; deny internal IP ranges and link-local addresses by default.
- Re-validate every redirect hop's Location header against the same policy used for the initial URL, rejecting redirects to disallowed hosts or schemes.
- Introduce network-layer egress controls (firewalls or proxy layers) to block requests to internal infrastructure and metadata services from automation runtimes.
- Separate high-privilege internal connectivity from general automation workloads, running HTTP-capable modules with least-privilege network access.
- Normalize and sanitize user-supplied URLs before use, and avoid treating arbitrary external URLs as trusted workflow inputs.
How teams detect issues like this
Organizations can detect and monitor SSRF risks in automation and agent frameworks by:
- Using static analysis or policy checks to flag HTTP client usage with
allow_redirects=Trueand missing per-hop validation or host restrictions. - Reviewing code for patterns where user-controlled URLs flow into HTTP modules without domain or IP range validation, particularly in automation and AI-agent orchestration logic.
- Implementing outbound request logging and egress monitoring to spot unusual traffic from automation nodes to internal IP ranges or cloud metadata endpoints.
- Employing configuration and policy enforcement in CI/CD pipelines to ensure new HTTP integrations adhere to strict destination and redirect validation rules.
- Periodically conducting security reviews of workflow templates and agent behaviors that perform external HTTP calls, looking for SSRF-prone patterns.
Organizations can detect and monitor SSRF risks in automation and agent frameworks by:
- Using static analysis or policy checks to flag HTTP client usage with
allow_redirects=Trueand missing per-hop validation or host restrictions. - Reviewing code for patterns where user-controlled URLs flow into HTTP modules without domain or IP range validation, particularly in automation and AI-agent orchestration logic.
- Implementing outbound request logging and egress monitoring to spot unusual traffic from automation nodes to internal IP ranges or cloud metadata endpoints.
- Employing configuration and policy enforcement in CI/CD pipelines to ensure new HTTP integrations adhere to strict destination and redirect validation rules.
- Periodically conducting security reviews of workflow templates and agent behaviors that perform external HTTP calls, looking for SSRF-prone patterns.
