Server-Side Request Forgery in OpenViking

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in OpenViking before version 0.3.4. It allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the /api/v1/resources endpoint. The server processes these URLs and makes outbound requests to private addresses like loopback, RFC 1918 ranges, or cloud metadata services. Attackers can then read responses through normal APIs to enumerate and interact with internal services.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability, monitor for unusual outbound HTTP requests from your OpenViking server to internal or private IP ranges. Check logs for POST requests to /api/v1/resources with URLs pointing to loopback (127.0.0.1), RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), or cloud metadata addresses (e.g., 169.254.169.254).

Use network monitoring tools like tcpdump or Wireshark to capture outbound traffic from the OpenViking server. Look for HEAD or GET requests to these restricted addresses. Additionally, inspect API logs for repeated or suspicious requests to /api/v1/resources.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive internal services, steal data, or pivot to other systems within your network. Since it requires authentication but low privileges, it could lead to data breaches, unauthorized access to cloud metadata, or further network compromise if internal services are vulnerable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenViking to version 0.3.4 or later immediately. This version includes fixes that validate and block requests to private network addresses. If upgrading is not possible, apply the network validation changes from the patch manually.

Restrict access to the /api/v1/resources endpoint to trusted users only. Implement network-level controls to block outbound requests to private IP ranges from the OpenViking server. Review and remove any unnecessary internal services that could be targeted.

Useful 0 Not Useful 0