SSRF in QD Server via Unauthenticated /har/test Endpoint

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the /har/test endpoint of QD software versions 20220208 through 20250803. The flaw allows unauthenticated remote attackers to force the server to send arbitrary HTTP requests to internal networks or cloud metadata endpoints by exploiting improper URL validation in the Fetcher.build_request() function.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual outbound HTTP requests from your QD server, especially to internal or cloud metadata endpoints. Monitor logs for requests to the /har/test endpoint without authentication. Use network traffic analysis tools like tcpdump or Wireshark to inspect outbound connections from the QD server process.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate sensitive data, or interact with cloud provider metadata services. Since TLS verification is disabled, attackers may also intercept or manipulate traffic. The lack of authentication requirements means any remote user can launch attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR) and healthcare (HIPAA) due to unauthorized access to internal systems and potential data breaches. It undermines security controls for protecting sensitive data and could result in regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the /har/test endpoint if not needed. Implement strict URL validation in libs/fetcher.py to restrict allowed schemes, hosts, and IP ranges. Require authentication for the /har/test endpoint. Enable TLS verification by setting validate_cert to True in HTTPRequest construction.

Useful 0 Not Useful 0