RockteMQ-AI commented on issue #1509: URL: https://github.com/apache/rocketmq-dashboard/issues/1509#issuecomment-5248195046
**Issue Evaluation** Category: `bug` | Status: **Confirmed** (Security) This is a valid SSRF bypass vulnerability. The `isAllowedDataSourceHost()` guard relies on Java's `InetAddress` classification (any-local, link-local, loopback, site-local), which does not cover documented cloud metadata endpoints: - **AWS EC2 IMDS IPv6:** `fd00:ec2::254` — not classified as link-local by Java - **Alibaba Cloud ECS metadata:** `100.100.100.200` — not classified as link-local or site-local by Java **Root Cause:** The SSRF guard uses Java address category checks instead of an explicit blocklist for known cloud metadata endpoints. **Impact:** Server-side data-source connection test can reach cloud instance metadata services, potentially exposing IAM credentials and instance identity documents. **Severity:** High — security vulnerability with potential for credential exposure **Note:** The referenced `SettingsService.isAllowedDataSourceHost()` code resides on the `rocketmq-studio` branch. Verification was based on the detailed issue description and the documented metadata endpoint addresses. An automated fix proposal can be generated once the `rocketmq-studio` branch is accessible. Reply `/approve` to proceed with PR generation when the branch is available. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
