SSRF via DNS Resolution Bypass in url_manual Fetch
Summary
RomM's server-side URL fetch for ROM manual resources (PUT /api/roms/{id}, field url_manual) validates only literal IP addresses and a fixed set of reserved hostname strings. The validator explicitly skips DNS resolution [REDACTED], so any attacker-controlled hostname that resolves to a private, loopback, or link-local IP address passes validation unchallenged. After validation succeeds, the server issues a real outbound GET request via httpx to the attacker-supplied URL and stores the response body as a static file that is then served publicly through nginx. This constitutes a non-blind Server-Side Request Forgery (SSRF): an authenticated user with only roms.write permission can exfiltrate data from internal HTTP services by reading the saved file from the public /assets/romm/resources/ path.
Details
[REDACTED]
PoC
[REDACTED]
Impact
This is a non-blind Server-Side Request Forgery (SSRF). An attacker who holds a valid RomM account with roms.write permission (the default permission for any editor-role user) can:
- Exfiltrate data from internal HTTP services — any service on the RomM host's loopback interface (
127.0.0.x), its Docker network, or the broader private network that returns application/octet-stream, application/pdf, or application/force-download content. The response body is persisted to disk and served via a public nginx static path, making the exfiltration non-blind and repeatable.
- Enumerate internal network topology — HTTP 200/4xx/5xx status codes and file sizes differ by host/port, enabling port and service scanning.
- Interact with internal APIs — any internal service reachable as a GET endpoint (metadata services, health APIs, internal dashboards) is reachable, subject to the content-type filter.
The attacker does not need administrator privileges; the roms.write scope is available to editor accounts. No server-side configuration change is required to expose the vulnerability; it is present in the default installation.
The confidentiality impact is high because sensitive internal data (cloud instance metadata, internal credentials, configuration files served over HTTP) can be exfiltrated and read by the attacker through the public static file endpoint.
Reproduction artifacts
[REDACTED]
SSRF via DNS Resolution Bypass in
url_manualFetchSummary
RomM's server-side URL fetch for ROM manual resources (
PUT /api/roms/{id}, fieldurl_manual) validates only literal IP addresses and a fixed set of reserved hostname strings. The validator explicitly skips DNS resolution [REDACTED], so any attacker-controlled hostname that resolves to a private, loopback, or link-local IP address passes validation unchallenged. After validation succeeds, the server issues a real outboundGETrequest viahttpxto the attacker-supplied URL and stores the response body as a static file that is then served publicly through nginx. This constitutes a non-blind Server-Side Request Forgery (SSRF): an authenticated user with onlyroms.writepermission can exfiltrate data from internal HTTP services by reading the saved file from the public/assets/romm/resources/path.Details
[REDACTED]
PoC
[REDACTED]
Impact
This is a non-blind Server-Side Request Forgery (SSRF). An attacker who holds a valid RomM account with
roms.writepermission (the default permission for any editor-role user) can:127.0.0.x), its Docker network, or the broader private network that returnsapplication/octet-stream,application/pdf, orapplication/force-downloadcontent. The response body is persisted to disk and served via a public nginx static path, making the exfiltration non-blind and repeatable.The attacker does not need administrator privileges; the
roms.writescope is available to editor accounts. No server-side configuration change is required to expose the vulnerability; it is present in the default installation.The confidentiality impact is high because sensitive internal data (cloud instance metadata, internal credentials, configuration files served over HTTP) can be exfiltrated and read by the attacker through the public static file endpoint.
Reproduction artifacts
[REDACTED]