Summary
Kubeflow Pipelines' artifact retrieval route can be induced to request internal HTTP resources when caller-controlled destination values pass inadequate host validation. Depending on deployment configuration, this may be reachable without authentication or by a low-privilege tenant, and the response body may be returned to the caller.
Kubeflow Pipelines' artifact retrieval route can be induced to request internal HTTP resources when caller-controlled destination values pass inadequate host validation. Depending on deployment configuration, this may be reachable without authentication or by a low-privilege tenant, and the response body may be returned to the caller.
Affected context
The issue is in the frontend GET /artifacts/get route when HTTP or HTTPS sources are accepted and bucket and key values influence the destination. Validation may permit an all-digit decimal host that the URL parser interprets as an IPv4 address. The risk is heightened by permissive default artifact-domain settings and standalone deployments with authorization disabled; authenticated multi-user deployments may also be affected when a low-privilege tenant has a valid identity and authorized namespace.
The issue is in the frontend GET /artifacts/get route when HTTP or HTTPS sources are accepted and bucket and key values influence the destination. Validation may permit an all-digit decimal host that the URL parser interprets as an IPv4 address. The risk is heightened by permissive default artifact-domain settings and standalone deployments with authorization disabled; authenticated multi-user deployments may also be affected when a low-privilege tenant has a valid identity and authorized namespace.
Exploit preconditions
- Attack surface: The frontend artifact retrieval route, with HTTP or HTTPS sources enabled.
- Required access: None in an authorization-disabled standalone configuration; in authenticated multi-user configurations, a valid identity and an authorized namespace are required.
- Trigger point: A request to retrieve an artifact using caller-controlled bucket and key values.
- Why exploitation is possible: Destination validation may accept a numeric host representation that the URL parser resolves to an IPv4 address, allowing requests to internal destinations under applicable configuration.
- Attack surface: The frontend artifact retrieval route, with HTTP or HTTPS sources enabled.
- Required access: None in an authorization-disabled standalone configuration; in authenticated multi-user configurations, a valid identity and an authorized namespace are required.
- Trigger point: A request to retrieve an artifact using caller-controlled bucket and key values.
- Why exploitation is possible: Destination validation may accept a numeric host representation that the URL parser resolves to an IPv4 address, allowing requests to internal destinations under applicable configuration.
Why this happens
The underlying issue is insufficient server-side destination validation, mapping to CWE-918: Server-Side Request Forgery (SSRF). Validation and URL interpretation do not consistently agree about the meaning of an all-digit decimal host, so a destination that passes an allowlist check may resolve to an internal IPv4 address. The server then makes the request and can expose its response body to the caller.
The underlying issue is insufficient server-side destination validation, mapping to CWE-918: Server-Side Request Forgery (SSRF). Validation and URL interpretation do not consistently agree about the meaning of an all-digit decimal host, so a destination that passes an allowlist check may resolve to an internal IPv4 address. The server then makes the request and can expose its response body to the caller.
Potential impact
- An attacker may retrieve responses from reachable internal HTTP services.
- Internal service data could be disclosed to an unauthenticated caller or an authorized low-privilege tenant, depending on configuration.
- Cloud credential disclosure could occur only if relevant metadata services are reachable and credentials are attached; this issue does not establish an IMDSv2 bypass or credential access when metadata is blocked.
- Internal services could be probed through the application's network position.
- An attacker may retrieve responses from reachable internal HTTP services.
- Internal service data could be disclosed to an unauthenticated caller or an authorized low-privilege tenant, depending on configuration.
- Cloud credential disclosure could occur only if relevant metadata services are reachable and credentials are attached; this issue does not establish an IMDSv2 bypass or credential access when metadata is blocked.
- Internal services could be probed through the application's network position.
General mitigation guidance
Defensive patterns focus on validating the final network destination, not just the input hostname.
- Use strict, secure-by-default destination allowlists and reject ambiguous or non-canonical host representations.
- Resolve and validate addresses, and prevent requests to loopback, link-local, private, or otherwise disallowed ranges as appropriate to the deployment.
- Restrict supported schemes and avoid making requests to caller-selected destinations when a controlled artifact retrieval mechanism is available.
- Keep authorization enabled, apply least privilege to tenant access, and limit the application's network reachability.
- Treat artifact location values as untrusted input and avoid exposing internal response bodies to callers.
Defensive patterns focus on validating the final network destination, not just the input hostname.
- Use strict, secure-by-default destination allowlists and reject ambiguous or non-canonical host representations.
- Resolve and validate addresses, and prevent requests to loopback, link-local, private, or otherwise disallowed ranges as appropriate to the deployment.
- Restrict supported schemes and avoid making requests to caller-selected destinations when a controlled artifact retrieval mechanism is available.
- Keep authorization enabled, apply least privilege to tenant access, and limit the application's network reachability.
- Treat artifact location values as untrusted input and avoid exposing internal response bodies to callers.
How teams detect issues like this
- Use static analysis and code review to identify server-side HTTP clients whose destinations are influenced by request parameters.
- Review hostname allowlist checks for differences between validation, URL parsing, and DNS or address resolution.
- Enforce policy checks that require approved schemes and destinations and block requests to restricted address ranges.
- Monitor artifact retrieval logs and outbound network traffic for requests to unexpected internal or link-local destinations.
- Automated security review tools can help flag user-controlled values flowing into server-side request APIs.
- Use static analysis and code review to identify server-side HTTP clients whose destinations are influenced by request parameters.
- Review hostname allowlist checks for differences between validation, URL parsing, and DNS or address resolution.
- Enforce policy checks that require approved schemes and destinations and block requests to restricted address ranges.
- Monitor artifact retrieval logs and outbound network traffic for requests to unexpected internal or link-local destinations.
- Automated security review tools can help flag user-controlled values flowing into server-side request APIs.
