GHSA-vqrw-qphh-p34v TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
Summary`PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSRF protection whatsoever**. Any authenticated user can submit a JSON body `{ "type": "...", "url": "<attacker url>" }`; the server calls `fetch(url)` against that URL and then reflects the response body (`name`, `attribution`, `tiles[0]`, zoom levels) back to the caller in the `OptionalTileJSON` response.Because there is no IP-address classification, internal-only services are reachable: cloud metadata (`http://169.254.169.254/...`), loopback (`http://127.0.0.1/...`), RFC1918 ranges, and CGNAT. The response body flows back to the attacker, making this a **full-read SSRF** (not blind): the attacker reads the internal HTTP response verbatim. This enables theft of cloud instance credentials, internal service enumeration, and reading of internal-only HTTP endpoints from the network position of the CloudTAK API server.The only URL check in the basemap protocol layer (`BasemapProtocol.isValidURL`, `api/lib/interface-basemap.ts`) validates the scheme is `http`/`https` only and performs **no host/IP filtering** — and the import path does not even call it; it goes straight from `new URL(rawURL)` to `fetch(url)`.Three independent bypass classes were confirmed end-to-end against a real deployed build:Direct internal/loopback IP literals.Alternate IP encodings (e.g. decimal `http://2130706433/` = `127.0.0.1`).Redirect following — `fetch` uses the default `redirect: 'follow'`, so even a public initial host that 302-redirects to an internal address is followed with no re-validation.Vulnerable code (file:line)`api/routes/basemap.ts` — `importBasemapURL()` and the `PUT /basemap` handler (line numbers at commit `90d43bdd2fb7d9bd57cbce28c709d9e5207a475a`):https://github.com/dfpc-coe/CloudTAK/blob/64bc1886ff56b62f53d765d69ac90ff9fc23b54b/api/routes/basemap.ts#L68-L136The handler at `api/routes/basemap.ts` L139–L233 mounts this as `PUT /api/basemap` and gates it only with `Auth.is_auth(config, req)` (L157), i.e. **any authenticated user** with `application/json` body `{ type, url }` reaches `importBasemapURL((req.body).url, (req.body).auth)`.`BasemapProtocol.isValidURL` at `api/lib/interface-basemap.ts` L136 — the only "validation" in the protocol layer — checks the scheme only and performs no IP filtering:https://github.com/dfpc-coe/CloudTAK/blob/64bc1886ff56b62f53d765d69ac90ff9fc23b54b/api/lib/interface-basemap.ts#L136-L148How input reaches the sinkAttacker authenticates as any CloudTAK user (any role) and obtains a bearer token.Attacker sends `PUT /api/basemap` with `Content-Type: application/json` and body `{ "type": "...", "url": "<attacker url>" }`.Handler `api/routes/basemap.ts` L155–L233 calls `Auth.is_auth(config, req)` (L157, any authenticated user passes) then `importBasemapURL(config, (req.body).url, (req.body).auth)` (L233).`importBasemapURL` (L68) does `new URL(rawURL)` (L79) and, for non-ESRI URLs, reaches `const tjres = await fetch(url)` (L99) — the SSRF sink. No host/IP classification occurs anywhere on this path; `fetch` uses the default `redirect: 'follow'`.The response JSON is parsed (L104) and `name` / `attribution` / `tiles[0]` are copied into the response object (L106–L117) and returned to the attacker — closing the read loop.ImpactServer-side full-read SSRF from the network position of the CloudTAK API server, reachable by any single authenticated user:Read the cloud instance metadata endpoint (`http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>`) and exfiltrate temporary IAM credentials.Reach and read internal-only HTTP services (databases' HTTP UIs, admin panels, other microservices) not exposed to the internet.Enumerate internal hosts/ports via response/timing differences.Because the fetched body is reflected back to the caller, the attack is non-blind (full response disclosure), not merely a blind request-forgery.Proof of conceptEnd-to-end reproduction against a **real deployed CloudTAK API server** (not a unit harness). An internal-only sentinel HTTP service is bound to `127.0.0.1:9000` (loopback only, unreachable from outside the host) and returns a TileJSON body carrying secret marker values; the proof is that the CloudTAK server fetches it server-side and reflects those secrets back to the attacker.Pinned install / build (v13.5.0, commit `64bc1886ff56b62f53d765d69ac90ff9fc23b54b`):Deploy the real API server (test stack: SigningSecret defaults to the hardcoded `coe-wildland-fire`, migrations auto-apply, a default server row is auto-generated):Internal-only sentinel (`internal_sentinel.js`) — simulates an internal HTTP service / metadata endpoint, bound to loopback only:Attacker driver — mint a normal user JWT (signed with the deployed `SigningSecret`) and issue the three requests:Captured output — all three return the internal sentinel's secret body to the attacker, and the loopback-only sentinel records the server-side hits:The `name` and `attribution` values returned to the attacker are read verbatim from the internal service's HTTP response, demonstrating full-read SSRF. In a real cloud deployment the equivalent request `http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>` returns instance-role credentials.Negative control — a public host is fetched normally (the endpoint is not globally broken); only the *reachability* of internal addresses is the defect.End-to-end reproduction (against pinned version)All of the above was executed against a real deployed CloudTAK API server built from tag `v13.5.0` (commit `64bc1886ff56b62f53d765d69ac90ff9fc23b54b`), booted with `StackName=test` against a PostGIS-enabled Postgres so migrations and routes load unmodified. The vulnerable build returned the internal sentinel's secret body (`INTERNAL-METADATA-aws-iam-role-SECRET-7f3a9c`, `leaked-internal-credential::AKIA-SENTINEL-DO-NOT-REDACT-9b2e`) for all three bypass variants, and the loopback-only sentinel recorded the three server-side hits shown above.After applying the fix below to the same deployed build and restarting, the exact same three attacker requests instead return:and the sentinel log records **no** new hits, while `https://example.com/tile.json` continues to be fetched (returns `400 "Unable to fetch TileJSON"` — it reached the public host, the body just is not valid TileJSON). An `isBlockedIP` unit check passes 14/14: `169.254.169.254`, `127.0.0.1`, `10/8`, `172.16/12`, `192.168/16`, `100.64/10`, `::1`, `::ffff:127.0.0.1`, `fd00::/8`, `fe80::/10`, `64:ff9b::/96` all blocked; `8.8.8.8`, `1.1.1.1`, `93.184.216.34` all allowed.Suggested fixAdd an SSRF guard that (1) resolves the target hostname via DNS and rejects the request if **any** resolved address falls in a loopback / private / link-local (incl. `169.254.0.0/16` cloud metadata) / CGNAT / IPv6-ULA / IPv4-mapped / NAT64 range, and (2) follows redirects manually, re-validating the `Location` of every hop so a 302 to an internal address cannot bypass the check. Apply it to the import sink at `api/routes/basemap.ts` (the `fetch(url)` call) and to the ESRI/metadata fetch paths in the same file.A self-contained `safeFetch(url)` helper (DNS resolution + per-hop re-validation) replacing the bare `fetch(url)` is sufficient; the same helper should back the other user-URL fetches in the basemap routes. A fix PR implementing exactly this guard is provided.Note: a literal-string/prefix host blocklist (e.g. matching `127.`, `10.`, `192.168.`) is **not** sufficient — it is bypassed by alternate IP encodings, IPv6-mapped forms, and DNS-rebinding hostnames. The guard must classify the **resolved** numeric address.SeverityHigh. Pre-conditions: a single authenticated CloudTAK user account (any role). Impact: server-side full-read access to internal-only HTTP services and the cloud metadata endpoint from the API server's network position, enabling theft of instance credentials and internal reconnaissance. No additional privileges or victim interaction required.Fix PR linkA fix PR implementing the DNS-resolving, redirect-re-validating `safeFetch` guard described above is provided to the maintainers via the private temporary fork associated with this advisory. The full guard source is also inlined under the Suggested fix section's reasoning above; the patch adds `api/lib/ssrf-guard.ts` and replaces the bare `fetch(url)` at `api/routes/basemap.ts` with `safeFetch(url)`.CreditsReported by tonghuaroot.
CVSS v3.1 score: 5