Description

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T17:17:28.123Z",
  "pubdate": "2026-08-13T17:17:28.123Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists within the restore-repo utility, specifically stemming from the processing of unsanitized data originating from the pull_request.yml Head.CloneURL parameter. This security flaw allows malicious actors to manipulate repository restoration procedures by supplying arbitrary URLs within the workflow configuration file. When the affected system parses and processes this untrusted input, it initiates outbound network requests to the attacker-controlled destination, exposing internal network infrastructure and sensitive metadata services to unauthorized access.\nThe vulnerability directly impacts systems executing the restore-repo tool utilizing workflow files with untrusted pull request data. Successful exploitation introduces severe risk implications, including internal network reconnaissance, potential data exfiltration, and unauthorized interaction with internal microservices that are otherwise inaccessible from the external perimeter. The attacker capabilities involve crafting malicious pull request payloads designed to trigger arbitrary outbound HTTP or protocol-specific requests from the host executing the restoration process.\nExploitation requirements rely on the ability of an adversary to inject or modify the pull_request.yml Head.CloneURL parameter within a context processed by the vulnerable restore-repo component. Mitigation requires strict input validation and sanitization procedures applied to all URL parameters derived from external configuration files prior to initiating network operations.",
  "technicalDetails": "The vulnerability is fundamentally rooted in the lack of input sanitization and validation within the restore-repo component when handling properties defined in workflow configuration files. Specifically, the Head.CloneURL field extracted from pull_request.yml is trusted implicitly and passed directly into underlying network request functions without verifying its schema, hostname, or destination IP address.\nThe vulnerable component resides in the repository restoration logic of restore-repo, which parses workflow definitions to automate setup tasks. Because the application fails to restrict outbound connection targets to an explicit allowlist or validate that the URL points to an expected, trusted version control provider domain, an attacker can supply arbitrary URIs, including loopback addresses (127.0.0.1), local network ranges (RFC 1918), or external domains controlled by the adversary.\nThe step-by-step attack flow proceeds as follows: First, an attacker crafts a malicious pull_request.yml file containing a modified Head.CloneURL value pointing to an arbitrary target, such as an internal metadata service (e.g., http://169.254.169.254/) or a listener on the local network. Second, the victim or an automated pipeline executes the restore-repo utility, which ingests the malicious workflow definition. Third, the application parses the Head.CloneURL parameter and attempts to initiate a clone or fetch operation against the attacker-specified URL. Fourth, the server executes the outbound request, potentially leaking internal server responses, environment variables, or cloud instance metadata back to the attacker or executing unauthorized requests against internal microservices.\nNetwork exposure is inherent to any deployment where restore-repo processes untrusted repository configurations in environments with network connectivity to internal resources or sensitive endpoints. Authentication and privilege requirements depend on the execution context of the restoration process, but the impact is magnified if the utility runs with elevated privileges or within a network zone trusted by internal services."
}