gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into sentinel-ssrf-imap-9566695902417221069

Browse Source
This commit is contained in:
Christian Krakau-Louis
2026-03-23 15:39:29 +01:00
committed by GitHub
parent d71945b7b9 45d3ac8cf0
commit d94e9ca4bc
186 changed files with 26498 additions and 1488 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.jules/sentinel.md
+4
View File
@@ -6,3 +6,7 @@
**Vulnerability:** Server-Side Request Forgery (SSRF) allowed users to port-scan or connect to internal services via user-provided `host` and `port` inputs in IMAP endpoints (`/test` and `pull_inbox`).
**Learning:** Endpoints testing outbound connections with user-provided configurations must validate the destination host before attempting the connection to prevent exploitation of the server's network position.
**Prevention:** Use network utilities like `is_private_ip` that resolve hostnames and block private/loopback/reserved IPs before establishing outbound connections.
## 2025-05-18 - [SSRF Bypass via DNS Resolution Failure]
**Vulnerability:** The `is_private_ip` function in `app/utils/network.py` failed open (returned `False`) when a hostname could not be resolved (`socket.gaierror`).
**Learning:** This fail-open pattern was originally added to allow external domains in tests, but in production, it created a severe SSRF risk. An attacker could bypass SSRF protections by providing a URL that fails to resolve during the security check but resolves later (DNS rebinding), or by exploiting internal routing behaviors via unresolvable addresses.
**Prevention:** Always fail securely in network authorization functions. If a domain cannot be resolved to verify its safety, the request must be blocked (`return True` / default-deny). Tests should mock DNS resolution correctly instead of compromising production security logic.