RockteMQ-AI commented on issue #1509:
URL: 
https://github.com/apache/rocketmq-dashboard/issues/1509#issuecomment-5248195046

   **Issue Evaluation**
   
   Category: `bug` | Status: **Confirmed** (Security)
   
   This is a valid SSRF bypass vulnerability. The `isAllowedDataSourceHost()` 
guard relies on Java's `InetAddress` classification (any-local, link-local, 
loopback, site-local), which does not cover documented cloud metadata endpoints:
   
   - **AWS EC2 IMDS IPv6:** `fd00:ec2::254` — not classified as link-local by 
Java
   - **Alibaba Cloud ECS metadata:** `100.100.100.200` — not classified as 
link-local or site-local by Java
   
   **Root Cause:** The SSRF guard uses Java address category checks instead of 
an explicit blocklist for known cloud metadata endpoints.
   **Impact:** Server-side data-source connection test can reach cloud instance 
metadata services, potentially exposing IAM credentials and instance identity 
documents.
   **Severity:** High — security vulnerability with potential for credential 
exposure
   
   **Note:** The referenced `SettingsService.isAllowedDataSourceHost()` code 
resides on the `rocketmq-studio` branch. Verification was based on the detailed 
issue description and the documented metadata endpoint addresses.
   
   An automated fix proposal can be generated once the `rocketmq-studio` branch 
is accessible. Reply `/approve` to proceed with PR generation when the branch 
is available.
   
   ---
   *Automated evaluation by RockteMQ-AI*
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to