Description

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The `imageUrl` validation logic can be bypassed through multiple techniques, including image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains. After validation, the server performs an unrestricted `fetch()` request to the supplied URL. This results in a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to reach internal network services, cloud metadata endpoints, and arbitrary external hosts from the application's network context. Additionally, response bodies are fully buffered before size validation, creating a potential memory exhaustion vector. Version 1.20.3 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-11T21:17:11.247Z",
  "pubdate": "2026-09-11T21:17:11.247Z",
  "executiveSummary": "Shelf versions prior to 1.20.3 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the Asset CSV Content Import feature. Authenticated users possessing the 'asset:import' permission can bypass inadequate input validation to force the server to initiate arbitrary HTTP requests.\nThis vulnerability stems from flawed 'imageUrl' validation logic that fails to adequately restrict target URLs, allowing for the traversal of internal network segments, interaction with cloud metadata services, and scanning of arbitrary external hosts from the application server's network context.\nThe impact is significant, as successful exploitation enables unauthorized internal reconnaissance, potential exfiltration of sensitive configuration data or credentials from cloud environments, and the ability to interact with internal services that are otherwise shielded from public access. Furthermore, the application's practice of buffering response bodies before performing size validation introduces an additional risk of memory exhaustion, potentially leading to a denial-of-service state. The vulnerability is effectively resolved in version 1.20.3, and stakeholders are strongly encouraged to upgrade to eliminate these attack vectors.",
  "technicalDetails": "The vulnerability resides in the server-side processing of the 'imageUrl' parameter during the Asset CSV Content Import routine. While the application attempts to validate the user-supplied URL to prevent unauthorized access, the implemented validation logic is insufficient and relies on insecure blacklisting and pattern matching techniques.\nExploitation is achieved by bypassing the 'imageUrl' validation logic. Attackers can circumvent these checks by utilizing image-extension suffixes, embedding image-related path keywords, employing domain substring matching techniques, or leveraging HTTP redirect chains to redirect the server to an unintended endpoint. Once the validation is bypassed, the application utilizes the 'fetch()' function to execute an unrestricted request to the attacker-defined destination.\nThe attack flow follows a sequential process: 1. The attacker prepares a malicious CSV file containing a crafted URL within the 'imageUrl' field. 2. The attacker, authenticated as a user with the 'asset:import' permission, uploads the CSV via the Asset CSV Content Import feature. 3. The application parser reads the input, executes the flawed validation checks, and erroneously deems the malicious URL legitimate. 4. The server executes a 'fetch()' call to the specified target. 5. If the target is an internal resource (e.g., cloud metadata services such as 169.254.169.254 or internal APIs), the server acts as a proxy, facilitating unauthorized access to the internal network environment.\nA secondary component of this vulnerability involves an unconstrained memory usage pattern. The server buffers the entirety of the response body from the target URL before applying size validation checks. An attacker can exploit this by directing the 'fetch()' call toward a resource that returns an excessively large payload, thereby consuming the server's available memory, potentially leading to application instability or a denial-of-service (DoS) condition.\nThis issue affects Shelf versions prior to 1.20.3. It requires an authenticated user with the 'asset:import' privilege, placing this vulnerability within the scope of both insider threats and compromised accounts. The resulting SSRF provides a pivot point for lateral movement and reconnaissance within the internal network context where the application is deployed."
}