pixelfed

Commit Graph

Author	SHA1	Message	Date
Your Name	9e84ad261d	Route StoryFetch outbound requests through SSRF-hardened fetch service	2 weeks ago
Your Name	aadde946d2	Apply Pint formatting to SecureMediaFetchService	4 weeks ago
Shlee	8123dcf934	Update SecureMediaFetchService.php	4 weeks ago
Your Name	3d82a8e8b2	Fix unauthenticated SSRF in remote media/avatar fetch (variant of CVE-2026-71246) The remote media path validated URLs only as strings (Helpers::validateUrl normalizes the host + checks a ban list) and then downloaded them with Http::head + file_get_contents($url), which resolve DNS themselves and follow redirects with no private-IP checks and no address pinning. A remote actor whose icon.url redirected to an internal address (e.g. 172.18.0.1 or 169.254.169.254) made the queue worker fetch internal content and, for image responses, republish it at a public avatar URL. No account required. Fixes: - Add SecureMediaFetchService: validates URL, resolves + rejects non-global IPs (fail-closed), pins the connection to the validated IP via CURLOPT_RESOLVE, disables auto-redirects with per-hop re-validation, and enforces https-only + a byte cap. Mirrors the ActivityPubFetchService hardening from CVE-2026-71246. - Route MediaStorageService head()/fetchAvatar()/remoteToCloud() through it, removing the bare Http::head and file_get_contents($url) sinks. - validateUrl(): when DNS verification is enabled, reject hosts that resolve into reserved ranges, closing the metadata.google.internal bypass. - Harden adjacent same-class sinks: CustomEmojiService (emoji doc + image + head), FetchCacheService/webfinger, and DiscoverActor. - Add regression tests (tests/Unit/ActivityPub/SsrfUrlValidationTest.php).	4 weeks ago

4 Commits (9e84ad261d375cf8761615f2518dc79d25e6d511)