Description

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-11-05T21:18:51.240Z",
  "pubdate": "2026-11-05T21:18:51.240Z",
  "executiveSummary": "Emissary versions prior to 8.51.0 contain a critical vulnerability in the navigation link processing logic.\nThe flaw manifests as an Open Redirect and Server-Side Request Forgery (SSRF) vulnerability due to improper validation of navigation URLs within the NavAction component.\nBy bypassing the VALID_LINK validation logic, an attacker can coerce the application into performing unauthorized requests to external origins or sensitive internal services.\nThis vulnerability is particularly severe in cloud-native environments, where an attacker can exploit the SSRF capability to access cloud metadata services, potentially leading to credential theft or infrastructure compromise.\nThe vulnerability originates from the application's failure to account for browser-level URL normalization when processing protocol-relative URLs (e.g., //attacker.com).\nSuccessful exploitation requires the attacker to influence the navigation parameters processed by the NavAction class, which may be reachable by unauthenticated or low-privileged users depending on the deployment configuration.\nThe risk includes full server-side request control, potential exfiltration of sensitive configuration data, and redirection of legitimate traffic to malicious phishing endpoints.",
  "technicalDetails": "The vulnerability resides in the src/main/java/emissary/server/mvc/NavAction.java file within the Emissary workflow engine. The core issue is an inadequate validation routine, specifically the VALID_LINK regex or verification logic, which fails to restrict protocol-relative URLs.\nIn web security, a protocol-relative URL, also known as a schemeless URL, begins with two forward slashes (e.g., //evil.com). When a browser encounters such a string in a redirect header or navigation context, it defaults to the protocol currently in use (HTTP or HTTPS).\nThe NavAction component processes configured navigation links, but because the input validation allows these protocol-relative strings, the application treats them as trusted local paths. When the server processes these inputs and subsequently issues a redirect or an internal request based on these links, it performs URL normalization.\nDuring this normalization process, the underlying HTTP client or server-side handler interprets the protocol-relative URL as a fully qualified external URL. This transition from a perceived relative path to an absolute external request facilitates Server-Side Request Forgery (SSRF).\nThe attack flow begins when an attacker provides a crafted protocol-relative URL to the NavAction endpoint. The application's VALID_LINK check incorrectly authorizes the input. When the workflow engine proceeds to dereference or redirect based on this input, it initiates a backend request to the specified host. Because this request originates from the Emissary server, it bypasses network-level access controls or firewall rules that might prevent external entities from accessing the internal infrastructure.\nIn cloud environments, this behavior is critical, as it enables the server to query instance metadata services (e.g., 169.254.169.254 in AWS/GCP). An attacker can leverage the SSRF primitive to exfiltrate IAM roles, temporary security credentials, or sensitive configuration data stored in the metadata service. Furthermore, the Open Redirect aspect allows attackers to redirect users to malicious domains under the guise of the legitimate Emissary host, facilitating social engineering and credential harvesting attacks.\nThe flaw is present in all versions prior to 8.51.0. Mitigation involves updating to version 8.51.0, which presumably implements strict validation of the URL scheme to ensure that only absolute, permitted protocols are accepted, or utilizes an allowlist of fully qualified domains for all navigation-related inputs."
}