HyperDX SSRF via ClickHouse Proxy Host Parameter

Executive Summary

HyperDX before version 2.31.0 has a server-side request forgery (SSRF) vulnerability. Authenticated team members can send requests to internal destinations by manipulating the host parameter in the ClickHouse proxy test endpoint. The server lacks URL validation or allowlist checks, allowing access to internal services and exposing sensitive data through reflected error responses.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in HyperDX versions before 2.31.0, check if the ClickHouse proxy test endpoint is accessible and if the host parameter is accepted without validation. Inspect server logs for unusual internal requests or error responses from the endpoint. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access internal APIs, container services, and cloud provider metadata endpoints. Sensitive internal service data may be disclosed through error responses, potentially leading to unauthorized access to confidential information or further exploitation of internal systems.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal APIs, container services, or cloud metadata endpoints, potentially exposing sensitive data such as IAM credentials or personal information. This may violate GDPR's data protection principles or HIPAA's safeguards for protected health information if such data is accessed or disclosed.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade HyperDX to version 2.31.0 or later to patch the SSRF flaw. If upgrading is not possible, restrict access to the ClickHouse proxy test endpoint and implement strict URL validation for the host parameter to prevent arbitrary internal requests.

Useful 0 Not Useful 0