Server-Side Request Forgery in Activepieces File URL Handler

Executive Summary

This vulnerability exists in activepieces up to version 0.83.0, specifically in the function handleUrlFile within the File URL Handler component. It allows an attacker to perform server-side request forgery (SSRF) by manipulating the function. The attack can be executed remotely, and the exploit is publicly available.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to server-side request forgery, which may allow an attacker to make unauthorized requests from the vulnerable server. This can potentially expose internal systems, access sensitive information, or cause other unintended interactions with internal or external services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows server-side request forgery (SSRF), enabling unauthorized access to internal network resources and metadata endpoints. This can lead to unauthorized data access or leakage, which may impact compliance with data protection regulations such as GDPR and HIPAA that require safeguarding sensitive information and preventing unauthorized access.

Specifically, the SSRF vulnerability could allow attackers to access internal services or sensitive data that should be protected under these regulations, potentially resulting in breaches of confidentiality and integrity requirements.

Remediation involves enforcing SSRF protections and rejecting unsafe URL schemes to mitigate these risks and help maintain compliance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the activepieces engine fetching URLs via the FILE property URL processor, bypassing SSRF protections and potentially accessing internal or metadata endpoints.

Detection can involve monitoring network traffic for unexpected requests originating from the activepieces engine to loopback addresses (e.g., 127.0.0.1), private IP ranges (RFC1918), link-local addresses, or cloud metadata service endpoints.

You can use network monitoring tools or commands such as:

• tcpdump or tshark to capture outgoing HTTP requests from the activepieces process, filtering for internal IP ranges.
• Example tcpdump command: sudo tcpdump -i any host 127.0.0.1 or net 10.0.0.0/8 or net 192.168.0.0/16 or net 172.16.0.0/12 and port 80 or port 443
• Use netstat or ss to check for active connections from the activepieces process to internal IPs.
• Review activepieces logs for any URL fetch attempts or errors related to URL processing.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves preventing the activepieces engine from fetching unsafe URLs that could lead to SSRF.

Recommended steps include:

• Restrict network access from the activepieces process to internal IP ranges and metadata service endpoints using firewall rules or network policies.
• Monitor and block any outgoing requests from activepieces to loopback, private, or link-local addresses.
• If possible, apply patches or updates that process FILE URLs through SSRF-safe clients or guards, rejecting unsafe schemes and enforcing time/size limits.
• Until a vendor patch is available, consider disabling or limiting the use of the FILE property URL handler in workflows.

Useful 0 Not Useful 0