Description

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-24T11:16:38.233Z",
  "pubdate": "2026-08-24T11:16:38.233Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the Hugo static site generator, specifically within the handling of outbound HTTP fetches initiated by resources.GetRemote. The vulnerability arises because the security mechanism relies strictly on string-based allowlist inspection of the URL text via CheckAllowedHTTPURL within config/security/securityConfig.go, without performing actual DNS resolution or evaluating the resolved IP addresses against internal, loopback, or cloud-metadata network ranges. Furthermore, the underlying HTTP client constructed in resources/resource_factories/create/create.go lacks any dial-time validation hooks to intercept outgoing connections at the transport layer.\nThe impact of this flaw allows an attacker capable of supplying arbitrary URLs through content vectors—such as front-matter fields or Content Management System (CMS) inputs—to force the Hugo build process to issue requests to internal endpoints, private networks, or cloud metadata services. The HTTP response body returned from these internal resources is subsequently embedded directly into the generated static site artifacts, effectively exfiltrating internal data into publicly accessible build outputs. The risk is high for environments where Hugo builds untrusted content, as no authentication or special privileges are required by the attacker beyond the ability to inject a malicious URL into the build source.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient validation and a lack of DNS resolution during the security allowlist evaluation of outbound URLs. When resources.GetRemote is invoked, Hugo passes the target URL to CheckAllowedHTTPURL located in config/security/securityConfig.go. This function evaluates the provided URL text against the configured security.http.urls allowlist patterns and performs checks on a canonicalised form of integer, hex, or octal IPv4 representations. However, it fails to resolve the hostname to its underlying IP address and does not inspect the actual network destination that the HTTP client will connect to.\nDuring the exploitation phase, an attacker provides a specially crafted URL or a hostname that resolves to a restricted network location—such as the loopback interface (127.0.0.1), private RFC 1918 address spaces, or cloud metadata endpoints (e.g., 169.254.169.254)—while matching the superficial string patterns of the security allowlist. Because the client implementation constructed in resources/resource_factories/create/create.go does not install any dial-time security hooks or transport-layer filters, the underlying network stack proceeds to establish a TCP connection to the internal target.\nThe attack flow proceeds as follows: First, the attacker injects the malicious URL into a build-time data vector, such as a front-matter field or a CMS input field processed by Hugo. Second, during the site compilation phase, Hugo initiates a fetch operation via resources.GetRemote using the supplied URL. Third, the string-based validation in CheckAllowedHTTPURL permits the URL to pass. Fourth, the HTTP client connects to the internal or metadata service, bypassing network boundary controls. Finally, the internal service returns sensitive data (such as cloud instance metadata, internal service metrics, or internal network configurations) in the HTTP response body. Hugo captures this response and embeds it directly into the generated static HTML or asset files. Consequently, when the site is published, the build artifact carries the exfiltrated internal data out to the public domain, achieving complete data compromise."
}