pixelfed

Commit Graph

Author	SHA1	Message	Date
Your Name	aadde946d2	Apply Pint formatting to SecureMediaFetchService	4 weeks ago
Shlee	8123dcf934	Update SecureMediaFetchService.php	4 weeks ago
Your Name	3d82a8e8b2	Fix unauthenticated SSRF in remote media/avatar fetch (variant of CVE-2026-71246) The remote media path validated URLs only as strings (Helpers::validateUrl normalizes the host + checks a ban list) and then downloaded them with Http::head + file_get_contents($url), which resolve DNS themselves and follow redirects with no private-IP checks and no address pinning. A remote actor whose icon.url redirected to an internal address (e.g. 172.18.0.1 or 169.254.169.254) made the queue worker fetch internal content and, for image responses, republish it at a public avatar URL. No account required. Fixes: - Add SecureMediaFetchService: validates URL, resolves + rejects non-global IPs (fail-closed), pins the connection to the validated IP via CURLOPT_RESOLVE, disables auto-redirects with per-hop re-validation, and enforces https-only + a byte cap. Mirrors the ActivityPubFetchService hardening from CVE-2026-71246. - Route MediaStorageService head()/fetchAvatar()/remoteToCloud() through it, removing the bare Http::head and file_get_contents($url) sinks. - validateUrl(): when DNS verification is enabled, reject hosts that resolve into reserved ranges, closing the metadata.google.internal bypass. - Harden adjacent same-class sinks: CustomEmojiService (emoji doc + image + head), FetchCacheService/webfinger, and DiscoverActor. - Add regression tests (tests/Unit/ActivityPub/SsrfUrlValidationTest.php).	4 weeks ago

Author

SHA1

Message

Date

Your Name

aadde946d2

Apply Pint formatting to SecureMediaFetchService

Shlee

8123dcf934

Update SecureMediaFetchService.php

Your Name

3d82a8e8b2

Fix unauthenticated SSRF in remote media/avatar fetch (variant of CVE-2026-71246)

The remote media path validated URLs only as strings (Helpers::validateUrl
normalizes the host + checks a ban list) and then downloaded them with
Http::head + file_get_contents($url), which resolve DNS themselves and
follow redirects with no private-IP checks and no address pinning. A remote
actor whose icon.url redirected to an internal address (e.g. 172.18.0.1 or
169.254.169.254) made the queue worker fetch internal content and, for
image responses, republish it at a public avatar URL. No account required.

Fixes:
- Add SecureMediaFetchService: validates URL, resolves + rejects non-global
  IPs (fail-closed), pins the connection to the validated IP via
  CURLOPT_RESOLVE, disables auto-redirects with per-hop re-validation, and
  enforces https-only + a byte cap. Mirrors the ActivityPubFetchService
  hardening from CVE-2026-71246.
- Route MediaStorageService head()/fetchAvatar()/remoteToCloud() through it,
  removing the bare Http::head and file_get_contents($url) sinks.
- validateUrl(): when DNS verification is enabled, reject hosts that resolve
  into reserved ranges, closing the metadata.google.internal bypass.
- Harden adjacent same-class sinks: CustomEmojiService (emoji doc + image +
  head), FetchCacheService/webfinger, and DiscoverActor.
- Add regression tests (tests/Unit/ActivityPub/SsrfUrlValidationTest.php).

3 Commits (1d712e14782eb08efa3be0c343d3544a46e7b37c)