Summary
This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combination regardless of present security mechanisms, and forcing the victim’s server into an infinite loop causing Denial of Service.
Moreover, this issue can also be maneuvered into performing a Blind SSRF attack.
Details
The Webfinger endpoint takes a remote domain for checking accounts as a feature, however, as per the ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on the security considerations section at B.3, access to Localhost services should be prevented while running in production.
The lookupWebFinger function, responsible for returning an actor handler for received actor objects from a remote server, can be abused to perform a Denial of Service (DoS) and Blind SSRF attacks while attempting to resolve a malicious actor’s object.
On Fedify, two client-facing functions implement the lookupWebFinger function- getActorHandle, and lookupObject, which are both used as a wrapper for the vulnerable lookup function.
As the lookupObject function is implemented only for CLI usage, we won’t focus our PoC and explanation on it, but it is still vulnerable in the same way getActorHandle is.
The getActorHandle function is a wrapper function for the getActorHandleInternal function (both present at /src/vocab/actor.ts):
async function getActorHandleInternal(
actor: Actor | URL,
options: GetActorHandleOptions = {},
): Promise<`@${string}@${string}` | `${string}@${string}`> {
const actorId = actor instanceof URL ? actor : actor.id;
if (actorId != null) {
const result = await lookupWebFinger(actorId, {
userAgent: options.userAgent,
tracerProvider: options.tracerProvider,
});
if (result != null) {
const aliases = [...(result.aliases ?? [])];
if (result.subject != null) aliases.unshift(result.subject);
for (const alias of aliases) {
const match = alias.match(/^acct:([^@]+)@([^@]+)$/);
if (match != null) {
const hostname = new URL(`https://${match[2]}/`).hostname;
if (
hostname !== actorId.hostname &&
!await verifyCrossOriginActorHandle(
actorId.href,
alias,
options.userAgent,
options.tracerProvider,
)
) {
continue;
}
return normalizeActorHandle(`@${match[1]}@${match[2]}`, options);
}
}
}
}
if (
!(actor instanceof URL) && actor.preferredUsername != null &&
actor.id != null
) {
return normalizeActorHandle(
`@${actor.preferredUsername}@${actor.id.host}`,
options,
);
}
throw new TypeError(
"Actor does not have enough information to get the handle.",
);
}
Miggo AI