Description

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-13T17:17:21.770Z",
  "pubdate": "2026-08-13T17:17:21.770Z",
  "executiveSummary": "This vulnerability is classified as a Blind Server-Side Request Forgery (SSRF) affecting the OAuth2 avatar synchronization feature within the application's OpenID Connect (OIDC) implementation.\nThe flaw arises due to the lack of input validation and sanitization on the picture claim provided during the OIDC authentication and synchronization process.\nAn attacker capable of manipulating the OIDC identity provider response can supply arbitrary URLs, forcing the vulnerable server to issue outbound HTTP or HTTPS requests to internal or external destinations.\nThe primary impact includes potential information disclosure regarding internal network topology, port scanning of internal services, and interaction with internal-only endpoints that are otherwise inaccessible from the public internet.\nThe risk implication is elevated if the internal network lacks proper segmentation, allowing the server executing the avatar synchronization to act as a pivot for internal reconnaissance.\nAttacker capabilities are limited to triggering outbound requests and potentially inferring responses based on timing differences or out-of-band interaction logs, characteristic of blind SSRF vectors.\nExploitation requires the ability to control or spoof the OIDC provider's claims or interact with the OAuth2 authorization flow where the victim application processes the unvalidated picture claim.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of the picture claim retrieved from the OIDC userinfo endpoint or ID token during the OAuth2 avatar synchronization workflow.\nWhen a user authenticates via OAuth2/OIDC, the application parses the returned JSON payload to extract user metadata, specifically looking for the picture attribute to automatically synchronize and cache the user's avatar image.\nThe vulnerable component fails to implement strict URL parsing, scheme whitelisting, or destination validation before passing the URL to the underlying HTTP client library for retrieval.\nAs a result, an attacker can specify arbitrary protocols and addresses, such as file://, dict://, gopher://, or standard HTTP/HTTPS URIs pointing to internal IP addresses (e.g., 127.0.0.1, 169.254.169.254, or internal RFC 1918 address spaces).\nThe attack flow proceeds as follows: First, the attacker initiates an authentication sequence using a rogue or controlled OIDC identity provider configured to return a malicious URI in the picture claim. Alternatively, if the application allows linking existing accounts to arbitrary external OIDC providers without restriction, the attacker supplies the payload during the profile update or synchronization trigger.\nSecond, the application processes the authentication callback, extracts the payload from the OIDC picture claim, and attempts to fetch the resource to store the avatar locally.\nThird, the server initiates an outbound network request to the specified target URL. Because the request originates from the backend server, it bypasses perimeter firewalls and network access control lists (ACLs) protecting internal resources.\nNetwork exposure is inherent to the server-side functionality performing the fetch operation. Authentication and privilege requirements depend on the specific implementation context; however, exploitation often requires only standard user privileges to trigger the profile synchronization mechanism or a compromised external identity provider.\nPost-exploitation impact includes internal service enumeration, exploitation of local network services vulnerable to HTTP requests (such as cloud metadata services), and potential denial of service if the application blocks threads waiting for responses from unresponsive internal ports."
}