RockteMQ-AI commented on issue #1647: URL: https://github.com/apache/rocketmq-dashboard/issues/1647#issuecomment-5250081376
**Issue Evaluation** Category: `type/bug` | Status: **Confirmed** The `AbstractPrometheusCompatibleMetricsSource` does not disable HTTP redirect following. An attacker who controls a metrics endpoint URL can redirect requests to internal services (e.g., cloud metadata at `169.254.169.254`), effectively bypassing SSRF protections that validate only the initial URL. **Severity:** High — security-relevant, enables SSRF via redirect to internal infrastructure. **Suggested Fix:** Disable redirect following on the HTTP client used for metrics scraping, or validate the final URL after redirects against the same allowlist. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
