GHSA-9c54-gxh7-ppjc Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
SummaryThe download service (`download_service.py`) makes HTTP requests using raw `requests.get()` without utilizing the application's SSRF protection (`safe_requests.py`). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls.**CWE**: CWE-918 (Server-Side Request Forgery)DetailsVulnerable Code Location**File**: `src/local_deep_research/research_library/services/download_service.py`The application has proper SSRF protection implemented in `security/safe_requests.py` and `security/ssrf_validator.py`, which blocks:Loopback addresses (127.0.0.0/8)Private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)AWS metadata endpoint (169.254.169.254)Link-local addressesHowever, `download_service.py` bypasses this protection by using raw `requests.get()` directly:Attack VectorAttacker submits a malicious URL via `POST /api/resources/<research_id>`URL is stored in database without SSRF validation (`resource_service.py:add_resource()`)Download is triggered via `/library/api/download/<resource_id>``download_service.py` fetches the URL using raw `requests.get()`, bypassing SSRF protectionPoCPrerequisitesDocker and Docker Compose installedPython 3.11+Step 1: Create the Mock Internal Service**File: `internal_service.py`**Step 2: Create the Exploit Script**File: `exploit.py`**Step 3: Run the PoCExpected OutputImpactWho is affected?All users running local-deep-research in:**Cloud environments** (AWS, GCP, Azure) - attackers can steal cloud credentials via metadata endpoints**Corporate networks** - attackers can access internal services and databases**Any deployment** - attackers can scan internal networksWhat can an attacker do?| Attack | Impact |
|--------|--------|
| Access cloud metadata | Potentially access IAM credentials, API keys, or instance identity in certain cloud configurations |
| Internal service access | Read sensitive data from databases, Redis, admin panels |
| Network reconnaissance | Map internal network topology and services |
| Bypass firewalls | Access services not exposed to the internet |Recommended FixReplace all `requests.get()` calls in `download_service.py` with `safe_get()` from `security/safe_requests.py`:The `safe_get()` function already validates URLs against SSRF attacks before making requests.Files to update:`src/local_deep_research/research_library/services/download_service.py` (9 occurrences)`src/local_deep_research/research_library/downloaders/base.py` (uses `requests.Session`)References[CWE-918: Server-Side Request Forgery (SSRF)](https://cwe.mitre.org/data/definitions/918.html)[OWASP SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)[AWS SSRF Attacks and IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html)[PortSwigger: SSRF](https://portswigger.net/web-security/ssrf)Thank you for your work on this project! I'm happy to provide any additional information or help with testing the fix.
CVSS v3.1 score: 6.3