-
Notifications
You must be signed in to change notification settings - Fork 842
Fix SSRF via jwks_uri #4000
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
strehle
wants to merge
6
commits into
develop
Choose a base branch
from
fix/security-finding-4-jwks-uri-ssrf
base: develop
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Fix SSRF via jwks_uri #4000
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
43 changes: 43 additions & 0 deletions
43
...r/src/main/java/org/cloudfoundry/identity/uaa/util/PrivateNetworkBlockingDnsResolver.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package org.cloudfoundry.identity.uaa.util; | ||
|
|
||
| import org.apache.hc.client5.http.DnsResolver; | ||
| import org.apache.hc.client5.http.SystemDefaultDnsResolver; | ||
|
|
||
| import java.net.InetAddress; | ||
| import java.net.UnknownHostException; | ||
| import java.util.Arrays; | ||
|
|
||
| /** | ||
| * DNS resolver that delegates to the system resolver and then rejects any address | ||
| * that falls in a private, loopback, link-local, or cloud-metadata range. | ||
| * | ||
| * Used as the DnsResolver for the RestTemplate that fetches client jwks_uri content, | ||
| * providing defense-in-depth against DNS rebinding after jwks_uri validation. | ||
| */ | ||
| public class PrivateNetworkBlockingDnsResolver implements DnsResolver { | ||
|
|
||
| public static final PrivateNetworkBlockingDnsResolver INSTANCE = new PrivateNetworkBlockingDnsResolver(); | ||
|
|
||
| private static final DnsResolver DELEGATE = SystemDefaultDnsResolver.INSTANCE; | ||
|
|
||
| private PrivateNetworkBlockingDnsResolver() {} | ||
|
|
||
| @Override | ||
| public InetAddress[] resolve(String host) throws UnknownHostException { | ||
| InetAddress[] addresses = DELEGATE.resolve(host); | ||
| InetAddress blocked = Arrays.stream(addresses) | ||
| .filter(PrivateNetworkGuard::isBlocked) | ||
| .findFirst() | ||
| .orElse(null); | ||
| if (blocked != null) { | ||
| throw new UnknownHostException( | ||
| "Host " + host + " resolves to a blocked address: " + blocked.getHostAddress()); | ||
| } | ||
| return addresses; | ||
| } | ||
|
|
||
| @Override | ||
| public String resolveCanonicalHostname(String host) throws UnknownHostException { | ||
| return DELEGATE.resolveCanonicalHostname(host); | ||
| } | ||
| } |
99 changes: 99 additions & 0 deletions
99
server/src/main/java/org/cloudfoundry/identity/uaa/util/PrivateNetworkGuard.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| package org.cloudfoundry.identity.uaa.util; | ||
|
|
||
| import java.net.InetAddress; | ||
| import java.net.URI; | ||
| import java.net.UnknownHostException; | ||
|
|
||
| /** | ||
| * Rejects hostnames that resolve to private, loopback, link-local, or cloud-metadata | ||
| * IP ranges. Used to prevent SSRF via operator-supplied fetch targets such as jwks_uri. | ||
| */ | ||
| public final class PrivateNetworkGuard { | ||
|
|
||
| // AWS/GCP/Azure instance-metadata address | ||
| private static final byte[] METADATA_V4 = {(byte) 169, (byte) 254, (byte) 169, (byte) 254}; | ||
| // RFC 6598 — Carrier-grade NAT (100.64.0.0/10) | ||
| private static final int RFC6598_START = (100 << 24) | (64 << 16); | ||
| private static final int RFC6598_END = (100 << 24) | (127 << 16) | (255 << 8) | 255; | ||
| // IPv4-mapped IPv6 prefix: ::ffff:0:0/96 | ||
| private static final byte[] IPV4_MAPPED_PREFIX = {0,0, 0,0, 0,0, 0,0, 0,0, (byte)0xff,(byte)0xff}; | ||
| private PrivateNetworkGuard() {} | ||
|
|
||
| /** | ||
| * Resolves all addresses for the host in {@code uri} and throws if any of them | ||
| * fall into a private, loopback, link-local, or well-known metadata range. | ||
| * | ||
| * @throws IllegalArgumentException if the host resolves to a blocked address | ||
| * @throws UnknownHostException if DNS resolution fails | ||
| */ | ||
| public static void assertPublic(URI uri) throws UnknownHostException { | ||
| String host = uri.getHost(); | ||
| if (host == null) { | ||
| throw new IllegalArgumentException("URI has no host: " + uri); | ||
| } | ||
| for (InetAddress addr : InetAddress.getAllByName(host)) { | ||
| if (isBlocked(addr)) { | ||
| throw new IllegalArgumentException( | ||
| "jwks_uri host resolves to a blocked (private/loopback/link-local) address: " + addr.getHostAddress()); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Returns true if the address must be blocked as an outbound fetch target. | ||
| */ | ||
| public static boolean isBlocked(InetAddress addr) { | ||
| if (addr.isLoopbackAddress()) { | ||
| return true; | ||
| } | ||
| if (addr.isLinkLocalAddress()) { | ||
| return true; | ||
| } | ||
| if (addr.isSiteLocalAddress()) { | ||
| return true; | ||
| } | ||
| if (addr.isMulticastAddress()) { | ||
| return true; | ||
| } | ||
| byte[] raw = addr.getAddress(); | ||
| // 169.254.169.254 — cloud instance-metadata (IPv4) | ||
| if (raw.length == 4 && raw[0] == METADATA_V4[0] && raw[1] == METADATA_V4[1] | ||
| && raw[2] == METADATA_V4[2] && raw[3] == METADATA_V4[3]) { | ||
| return true; | ||
| } | ||
| // Unspecified / any-local (0.0.0.0 or ::) | ||
| if (addr.isAnyLocalAddress()) { | ||
| return true; | ||
| } | ||
| // IPv6 unique-local (fc00::/7) | ||
| if (raw.length == 16 && (raw[0] & 0xfe) == 0xfc) { | ||
| return true; | ||
| } | ||
| // RFC 6598 — carrier-grade NAT (100.64.0.0/10) | ||
| if (raw.length == 4) { | ||
| int ip = ((raw[0] & 0xff) << 24) | ((raw[1] & 0xff) << 16) | ((raw[2] & 0xff) << 8) | (raw[3] & 0xff); | ||
| if (ip >= RFC6598_START && ip <= RFC6598_END) { | ||
| return true; | ||
| } | ||
| } | ||
| // IPv4-mapped IPv6 (::ffff:x.y.z.w) — check the embedded IPv4 part | ||
| if (raw.length == 16) { | ||
| boolean isMapped = true; | ||
| for (int i = 0; i < IPV4_MAPPED_PREFIX.length; i++) { | ||
| if (raw[i] != IPV4_MAPPED_PREFIX[i]) { | ||
| isMapped = false; | ||
| break; | ||
| } | ||
| } | ||
| if (isMapped) { | ||
| byte[] v4 = {raw[12], raw[13], raw[14], raw[15]}; | ||
| try { | ||
| return isBlocked(java.net.InetAddress.getByAddress(v4)); | ||
| } catch (java.net.UnknownHostException ignored) { | ||
| return true; | ||
| } | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
|
strehle marked this conversation as resolved.
|
||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.