Skip to content

SSRF Protection Bypass via DNS Rebinding in validate_url_for_http_request

Moderate
gantoine published GHSA-8w6h-m97h-67wv Jun 17, 2026

Package

pip romm (pip)

Affected versions

<= 3.7.1

Patched versions

>= 4.9.0

Description

Summary

validate_url_for_http_request() in backend/utils/validation.py is designed to prevent SSRF attacks by blocking private/internal IP addresses. However, it only checks literal IP addresses in the hostname — it does not resolve domain names before checking. This allows a trivial bypass via DNS rebinding or wildcard DNS services.

The function itself documents this limitation:

Note: This function does NOT perform DNS resolution. Domain names that resolve to private IPs will not be detected (DNS rebinding/internal DNS bypass possible).

Affected Code

[REDACTED]

Proof of Concept

[REDACTED]

Impact

[REDACTED]

Suggested Fix

Resolve the hostname to IP addresses before making the HTTP request, and validate the resolved IPs:

[REDACTED]

CVSS

5.5 MEDIUM — AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
(Requires EDITOR role = High privilege, but Changed scope since SSRF reaches internal network)

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs