Skip to content

v0.8.34 — DNS-rebinding-safe SafeURL egress guard (GHSA-mrvx-jmjw-vggc)

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 21 Jun 16:58
v0.8.34
9a5c314
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

fix(safeurl): resolve + re-validate at call time to defeat DNS-rebinding SSRF (GHSA-mrvx-jmjw-vggc)

Makes the SafeURL egress guard DNS-rebinding-safe. GHSA-mrvx-jmjw-vggc (SearXNG MCP Server, High, disclosed 2026-06-19): the host-allow check validated only the syntactic hostname string against a private-IP blocklist without resolving DNS, so an attacker domain resolving to a private/loopback IP (wildcard DNS like nip.io, or a custom record) passed the string check and the server then read arbitrary internal services.

  • SafeURLValidator gains dns_rebinding_guard (additive, default off; ON in the dns_rebinding_safe_url_defaults() OWASP-MCP preset): after the syntactic allowlist it resolves the host at call time and re-validates every resolved A/AAAA address against private/loopback/link-local/metadata (169.254.169.254, ::1, 127/8, 10/8, 172.16/12, 192.168/16, fc00::/7); unresolvable fails closed.
  • SafeURLValidator.resolve_and_pin(url) returns (url, pinned_ips) — resolve once, connect to the pinned IP (TOCTOU-safe).
  • Public SafeURL type / SafeURLValidator signature unchanged (diff-compatible). Complements the v0.8.29 SSRFEgressGuard.
  • 21 regression tests; built-wheel smoke confirms public resolution passes and a host resolving to 127.0.0.1 is blocked post-resolution. Pydantic-only core, no new runtime deps. (#102)

Source: GHSA-mrvx-jmjw-vggc

Assets 2
Loading