Description

Repository migration SSRF via multi-answer DNS allow-list bypass

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T17:17:28.227Z",
  "pubdate": "2026-08-13T17:17:28.227Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality.\nThe flaw allows attackers to bypass domain allow-lists by leveraging multi-answer DNS responses, leading to unauthorized access to internal network resources and sensitive metadata services.\nThe vulnerability impacts systems implementing domain validation logic that fails to properly resolve and validate all IP addresses associated with a target hostname.\nThe risk implication includes potential exposure of internal infrastructure, unauthorized data access, and remote code execution if internal services lack adequate authentication.\nAn attacker with the capability to initiate a repository migration can exploit this flaw by controlling a malicious DNS server that returns both public and internal IP addresses in multi-answer DNS queries.\nExploitation requires the ability to supply a custom repository URL to the migration feature and manipulate DNS responses to bypass security controls implemented during the validation phase.",
  "technicalDetails": "The root cause of the vulnerability lies in the asynchronous validation and connection phases of the repository migration feature, where DNS resolution results are handled inconsistently.\nDuring the validation phase, the application queries the target domain and evaluates the returned IP addresses against a predefined allow-list or block-list to prevent requests to internal networks, such as loopback interfaces, link-local addresses, and private subnet ranges.\nHowever, due to improper implementation of DNS resolution or time-of-check to time-of-use (TOCTOU) discrepancies, when the application subsequently establishes the actual network connection for the migration process, it performs a separate DNS lookup or handles multi-answer DNS responses in a way that allows internal IP addresses returned alongside public IPs to be targeted.\nAttackers exploit this behavior by setting up an authoritative DNS server for a domain under their control, configured to return a malicious multi-answer A or AAAA record set.\nThe DNS response contains at least one safe, publicly routable IP address that satisfies the initial allow-list validation checks performed by the repository migration component, alongside one or more internal IP addresses targeting sensitive internal endpoints.\nWhen the application evaluates the domain, the validation logic may process only the first IP address or fail to validate the complete set of resolved endpoints.\nSubsequently, during the connection phase, the underlying networking library or HTTP client attempts to connect to the resolved endpoints. Depending on the resolver behavior and load-balancing or fallback mechanisms, the connection is established with the internal IP address specified in the multi-answer DNS response.\nThis allows the attacker to force the server to issue HTTP requests, Git clone operations, or other network protocols directly to internal services that are otherwise inaccessible from the external network perimeter.\nThe vulnerable component is the repository migration URL parsing and DNS validation module.\nNetwork exposure is inherent to features that accept external URLs for processing, and exploitation can lead to severe post-impact conditions such as internal port scanning, service enumeration, and data exfiltration from internal network segments."
}