Description

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T17:17:30.493Z",
  "pubdate": "2026-08-13T17:17:30.493Z",
  "executiveSummary": "This vulnerability is classified as a Server-Side Request Forgery (SSRF) flaw occurring via migration asset downloads that bypass the implemented hostmatcher mechanism.\nThe primary impact of this vulnerability involves unauthorized read access to internal files and sensitive cloud metadata endpoints.\nThe affected systems comprise applications utilizing migration asset download functionalities equipped with flawed host validation routines.\nThe risk implications are severe, as successful exploitation exposes internal network resources, proprietary infrastructure configurations, and critical cloud instance metadata such as IAM credentials.\nAn attacker capable of exploiting this vulnerability possesses the ability to supply arbitrary URLs or manipulated endpoints during the migration asset retrieval process.\nExploitation requirements include the ability to trigger migration asset downloads and interact with the vulnerable parsing or downloading component, allowing requests to be routed away from intended external domains toward loopback or internal metadata IP addresses.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate sanitization, normalization, or validation within the hostmatcher component responsible for restricting outgoing requests during migration asset downloads.\nThe vulnerable component fails to properly account for variations in URL parsing, IP address representations, DNS rebinding, or redirection handling, allowing malicious payloads to circumvent the intended security controls.\nThe attack flow begins when an attacker supplies a crafted URL pointing to internal resources (such as 169.254.169.254 for cloud metadata or localhost references for internal files) instead of a legitimate migration asset source.\nBecause the hostmatcher logic contains bypasses—such as inconsistent parsing of alternative IP formats, URL-encoding tricks, or missing validation on HTTP redirects—the application's HTTP client blindly follows or directly retrieves the requested resource.\nNetwork exposure is present wherever the migration asset download feature is accessible to unauthenticated or authenticated users depending on the application context, with no strict restrictions on outbound socket connections to local or private network ranges.\nPayload behavior involves forcing the server-side application to initiate outbound HTTP requests to restricted internal services or local file paths exposed via URI wrappers or file retrieval routines.\nPost-exploitation impact includes the exfiltration of cloud metadata service tokens, internal configuration files, and source code, potentially leading to full compromise of the hosting infrastructure or underlying cloud environment."
}