ssrf external service interaction to malicious external source - security issue

[anwibugc]

Hi Imgix Team,

I have found security vulnerability issue w.r.t one application utilizing imgix framework

#Vulnerability description & attacker scenario:

External service interaction arises when it is possible to induce an application to interact with an arbitrary external service, such as a web or mail server. The ability to send requests to other systems can allow the vulnerable server to be used as an attack proxy. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. This may include public third-party systems, internal systems within the same organization, or services available on the local loopback adapter of the application server itself. Depending on the network architecture, this may expose highly vulnerable internal services that are not otherwise accessible to external attackers

Steps to Reproduce

1. Create a listener instance for ssrf external interaction purpose
   Access the site in incognito mode https://webhook.site/ it will create a listener for ssrf interaction such as https://webhook.site/#!/{{some random id}}

2.Copy the url of listener https://webhook.site/#!/{{some random id}} from created listener

3. Paste the listener url for ssrf https://webhook.site/#!/{{some random id}} to vulnerable parameter mark

https://images.pexels.com/photos/1168981/pexels-photo-1168981.jpeg?fit=&h=&mark=https://webhook.site/#!/{{some random id}}&markalign=&txt=&txtalign=&txtclr=&txtfont=&txtshad=&txtsize=&w=

4.Curl request that is generated from imgix application server
Curl request that is generated from imgix application server to webhook application listener this data is from interaction logs from webhook listener:

curl -X 'GET' 'https://webhook.site/9554d7ba-d76b-49f0-8fd9-ac1d480f4a77' -H 'connection: close' -H 'user-agent: imgix/2.0' -H 'accept-encoding: gzip' -H 'x-imgix-cache: MISS' -H 'x-imgix-hops: 1' -H 'x-imgix-id: 9d6c3a806cc8f1d43b714831abbc3d1617939d02' -H 'accept: /' -H 'host: webhook.site' -H 'content-length: ' -H 'content-type: '

You will see interaction in https://webhook.site/#!/ website

Proof of Concept - Steps to reproduce

1. Access the effected url with ssrf interaction url injected in mark parameter in query string

2. Interaction happened with listener

Business Impact

The ability to send requests to other systems can allow the vulnerable server to be used as an attack proxy. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. This may include public third-party systems, internal systems within the same organization, or services available on the local loopback adapter of the application server itself. Depending on the network architecture, this may expose highly vulnerable internal services that are not otherwise accessible to external attackers.

more details around vulnerability.
https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery

https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

[anwibugc]

@luqven , please review this security issue.

[sherwinski]

Hey there @anwibugc and thanks for bringing this to our attention. I've gone ahead and forwarded this to the relevant team for review and planning out any mitigation steps as deemed necessary.

[anwibugc]

Hi Team,

Hope you are doing well.

Any update for this?

[sherwinski]

Hey @anwibugc, I believe the team is actively looking into this. I'll be sure to follow up here with any updates as I receive them.

[anwibugc]

Hi @sherwinski @luqven,

Any update for this?

[anwibugc]

@sherwinski @luqven

Hi Team,

still no tag & assigned to this issue?

Please check once.

[sherwinski]

@anwibugc let me follow up with the team again.

[heyitsbryanm]

Hi @anwibugc - can you email support@imgix.com and reference this thread? We'd like to get more information from you so we can investigate further.

In the meantime, we're going to close this issue because it's not an imgix-rails issue. It's an issue with our Rendering API.