GitHub Security Advisory: GHSA-h6gw-8f77-mmmp
Package: github.com/Tencent/WeKnora (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 0.2.14
Patched in: 0.3.0

Summary: WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources

Details:
### Summary

A DNS rebinding vulnerability in the `web_fetch` tool allows an unauthenticated attacker to bypass URL validation and access internal resources on the server, including private IP addresses (e.g., 127.0.0.1, 192.168.x.x). By crafting a malicious domain that resolves to a public IP during validation and subsequently resolves to a private IP during execution, an attacker can access sensitive local services and potentially exfiltrate data.

### Details

The vulnerability exists because the `web_fetch` tool lacks complete DNS pinning. The application performs URL validation only once via `validateParams()`, but the URL is then passed unchanged to the `fetchHTMLContent()` function, which eventually reaches `fetchWithChromedp()`. The headless browser (Chromedp) resolves the hostname independently without DNS pinning, allowing a time-of-check-time-of-use (TOCTOU) attack.

**Validation phase (first DNS resolution):**
```go
if err := t.validateParams(p); err != nil {
    // Returns error for private IPs
    results[index] = &webFetchItemResult{
        err: err,
        // ...
    }
    return
}
```

**Execution phase (second DNS resolution):**
The original URL (not the resolved IP) is passed through the execution chain:
```go
output, data, err := t.executeFetch(ctx, p)
// Calls fetchHTMLContent(ctx, targetURL) where targetURL is the original hostname
```

**Chromedp execution (vulnerable DNS resolution):**
```go
func (t *WebFetchTool) fetchWithChromedp(ctx context.Context, targetURL string) (string, error) {
    // targetURL is not DNS-pinned; browser resolves it independently
    err := chromedp.Run(ctx,
        chromedp.Navigate(targetURL),  // Third DNS lookup occurs here
        chromedp.WaitReady("body", chromedp.ByQuery),
        chromedp.OuterHTML("html", &html),
    )
}
```

The attacker controls a domain that can be configured to return different DNS responses to different queries, enabling them to bypass the initial private IP check and access restricted resources during the actual fetch.

### PoC

**Setup:**
1. Deploy the DNS rebinding server (attached Python file) with the following systemd configuration:

```systemd
[Unit]
Description=DNS Rebinding Test Server
After=network.target

[Service]
Type=simple
User=root
WorkingDirectory=/root/Repos/dns-rebinding-server
ExecStart=/root/.proto/shims/python -u /root/Repos/dns-rebinding-server/server.py --token aleister1102 --domain aleister.ninja --port 53 --global-tracking --ip1 1.1.1.1 --ip2 0.0.0.0 --first-response-count 1 --reset-time 0
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target
 ```
 
 This configures the DNS server to:
 - Return `1.1.1.1` (a public IP) for the first DNS query
 - Return `127.0.0.1` (localhost) for all subsequent queries
 - TTL is set to 0 to prevent caching
 
 The sequence can also be reset via reset.domain.com (reset to 1.1.1.1).
 
 > Note: We may need to reset the sequence as the TOCTOU attack is not truly reliable and needs to be triggered m