[high] SSRF via cover_url #6

New issue

Closed

opened 2026-10-18 15:51:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:55 +00:00

Owner

Severity: high
Affects: main (also present on jtk/ebook-management)

Files: lib/fuzzy_catalog/storage.ex:241-243 (download_image), same call sites as above.
Req.get any user-supplied URL: localhost, 169.254.169.254, LAN admin panels; follows redirects; no body-size cap or timeout. The result is stored and served publicly if the response looks like an image.
Fix: http/https only; resolve host and reject loopback/private/link-local/ULA; redirect: false (or recheck each hop); receive_timeout; cap body size (e.g. 10 MB). Log status/host/duration.

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** high **Affects:** main (also present on jtk/ebook-management) Files: lib/fuzzy_catalog/storage.ex:241-243 (download_image), same call sites as above. Req.get any user-supplied URL: localhost, 169.254.169.254, LAN admin panels; follows redirects; no body-size cap or timeout. The result is stored and served publicly if the response looks like an image. Fix: http/https only; resolve host and reject loopback/private/link-local/ULA; redirect: false (or recheck each hop); receive_timeout; cap body size (e.g. 10 MB). Log status/host/duration. --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

labels

2026-10-18 15:51:55 +00:00

jfro referenced this issue

2026-10-18 15:55:29 +00:00

fix: only download covers from http(s) URLs, never local paths #18

jfro referenced this issue from a commit

2026-10-18 15:57:22 +00:00