RockteMQ-AI commented on issue #2832: URL: https://github.com/apache/rocketmq-dashboard/issues/2832#issuecomment-5467537422
**Issue Evaluation** Category: `bug` | Status: **Confirmed** The reported SSRF vulnerability in the primary `viewMessage` path is verified against the current codebase on the `rocketmq-studio` branch (specifically the `pr-2533-review` integration that includes PR #2339). **Root Cause:** PR #2339 added `validatedBrokerAddr` to the **fallback** path (`viewMessageByOffsetId`), but the **primary** lookup path remains unguarded in two methods: 1. `queryByMsgId()` — line 143: `adminExt.viewMessage(topic, msgId)` runs first, decoding the attacker-controlled `ip:port` from the forged offset msgId and opening a remoting connection before the guarded fallback is ever reached. 2. `resolveMessageStoreTimestamp()` — line 431: same pattern, `adminExt.viewMessage(topic, msgId)` without address validation. **Impact:** - Any authenticated reader-role user can make Studio open RocketMQ remoting connections to arbitrary internal endpoints (blind SSRF / port-scan oracle). - Against a broker address belonging to a different instance, the primary path returns that broker's message content — a cross-instance message read. **Severity:** High (SSRF + cross-instance data leak, exploitable by reader-role users) **Suggested Fix:** Decode the msgId and validate the embedded address with `validatedBrokerAddr` **before** invoking `adminExt.viewMessage(topic, msgId)` in both `queryByMsgId` and `resolveMessageStoreTimestamp`. IDs that do not decode as offset ids can pass through untouched — `MQAdminImpl` falls back to the unique-key lookup, which resolves brokers from the topic route and is not steerable. --- *Automated evaluation by github-manager-bot* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
