Repository navigation
Don't follow HTTP redirects in vuln_prober fetches - #25
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
_http_get used urllib's default urlopen, which follows 3xx including cross-host hops. A public scan target that 302s to metadata or RFC1918 let the agent fetch that body and confirm Tomcat/directory-listing findings from it. Refuse redirects the same way probe_open_redirect already does. Co-authored-by: dmitryflynn <dmitryflynn@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug and impact
src/vuln_prober.py_http_getusedurllib.request.urlopen, which follows 3xx by default — including cross-host hops. Scanning an authorized public HTTP target that returnsLocation: http://169.254.169.254/...(or RFC1918) made the agent fetch that body.That is scanner SSRF. It also confirmed false findings from the off-origin response: Tomcat Manager unauthenticated access (CRITICAL) and directory listing, with metadata-like content treated as evidence.
probe_open_redirectin the same file already refused redirects; the shared GET helper did not.This is distinct from #24 (header/stack/service/web fetchers). #24's helper comments that vuln_prober was already blocked, which was true only for the open-redirect probe, not
_http_get.Fix
_http_getnow uses a no-redirect opener (same pattern asprobe_open_redirect) and still applies the existing CERT_NONE TLS context. 3xx is returned as-is; callers that require 200/401 no longer confirm from a redirect destination.Validation
/secret:_http_getreturns 302, destination hit count stays 0, Tomcat and directory-listing probes return no finding.python3 -m pytest test_vuln_prober_redirect.py test_probers.py -q— 47 passed.