Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl() to resolve and validate a target hostname, but request-promise performs a separate DNS resolution for the actual connection. An authenticated user who can create or test API connections and controls the target DNS name can return a public address during validation and a private address during the request, bypassing the protections implemented by server/modules/outboundTargetPolicy.js. This DNS rebinding condition can expose internal services, localhost resources, or cloud metadata endpoints. This issue is fixed in version 5.2.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-21T22:16:57.823Z",
  "pubdate": "2026-09-21T22:16:57.823Z",
  "executiveSummary": "Chartbrew versions prior to 5.2.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability facilitated by a DNS rebinding attack.\nThe vulnerability arises from a Time-of-Check to Time-of-Use (TOCTOU) flaw in the URL validation process, specifically involving the asynchronous nature of DNS resolution between the validation and connection phases.\nAn authenticated attacker with the ability to configure API connections can manipulate DNS responses to bypass existing outbound traffic policies.\nThis allows the attacker to interact with restricted internal resources, including localhost services and cloud metadata endpoints (e.g., AWS/GCP instance identity services).\nThe risk is significant as it permits unauthorized lateral movement or information disclosure within the internal network segment where the Chartbrew server resides.\nExploitation requires the attacker to hold valid authentication credentials for the Chartbrew application and control a malicious DNS server that provides alternating IP address responses for a single domain name.",
  "technicalDetails": "The vulnerability originates in server/modules/safeRequest.js within the Chartbrew application. The security mechanism is designed to prevent SSRF by calling validateOutboundUrl() to resolve a target hostname against an outbound policy defined in server/modules/outboundTargetPolicy.js before executing an external request.\nThe root cause is a race condition induced by inconsistent DNS resolution. The validation function performs an initial DNS lookup to verify that the target host complies with internal security policies (e.g., ensuring it is not a private or loopback IP range). However, the subsequent network request is executed using the request-promise library, which performs an independent, secondary DNS resolution to establish the actual connection.\nAn attacker can exploit this via DNS rebinding. By controlling the DNS server for a malicious domain, the attacker provides a public, policy-compliant IP address during the initial validation check. Once the validation passes, the attacker modifies the DNS response for the same domain to return an internal or loopback IP address (e.g., 127.0.0.1 or 169.254.169.254).\nThe attack flow follows these steps: 1) The attacker initiates an API connection request through the Chartbrew interface using the malicious domain. 2) validateOutboundUrl() resolves the domain and receives a legitimate public IP, allowing the request to proceed. 3) The request-promise library triggers a new DNS resolution for the same domain. 4) The attacker's DNS server responds with a restricted internal address. 5) The server initiates the HTTP request to the internal destination, bypassing the initial policy enforcement. 6) The server returns the result of the internal request to the attacker, completing the unauthorized access.\nBecause the validation and the connection are decoupled, the system fails to maintain state consistency, rendering the outbound target policy ineffective against attackers capable of manipulating DNS resolution cycles.\nThis vulnerability effectively elevates the privileges of an authenticated user to perform network actions on behalf of the Chartbrew server, potentially leading to unauthorized data extraction from internal services, denial of service against local infrastructure, or credential theft via metadata service access."
}