Description

In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169.254.169.254) and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server issues a request to the attacker-supplied URL (server-side request forgery). For non-2xx responses, the target's response body is reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, making the SSRF readable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-25T19:16:55.080Z",
  "pubdate": "2026-08-25T19:16:55.080Z",
  "executiveSummary": "Dradis Community Edition (CE) is susceptible to a Server-Side Request Forgery (SSRF) vulnerability resulting from an authorization bypass flaw. The vulnerability resides in the ProvidersController and AgentsController, where the admin_required before_action relies on a constant, Dradis::Pro, that is never defined in the Community Edition. This failure leads to the authorization check being silently skipped, allowing non-administrative, authenticated users to access administrative functions.\nThe flaw enables an attacker to configure AI providers and modify agent settings to interact with arbitrary URIs, including internal network resources and sensitive metadata services like the link-local 169.254.169.254 host. The exploitation allows for unauthorized exfiltration of information through the reflection of error messages via ActionCable/Turbo Stream, as the system returns the response body of the forged request when non-2xx codes are returned. The vulnerability poses a significant risk to internal infrastructure by allowing blind and non-blind SSRF attacks, potentially leading to unauthorized data disclosure or exploitation of internal services protected by the network perimeter.",
  "technicalDetails": "The root cause of this vulnerability is an improper conditional authorization check within the Ruby on Rails controllers. The controllers ProvidersController and AgentsController utilize an admin_required filter designed to restrict access; however, the guard clause is defined as defined?(Dradis::Pro). Because the Dradis::Pro constant does not exist in the Community Edition codebase, the condition evaluates to false, effectively neutralizing the security constraint. This logic error grants low-privileged authenticated users full access to administrative endpoints.\nThe exploitation flow begins with an attacker authenticating to the Dradis CE instance. Once authenticated, the attacker accesses the unprotected ProvidersController to register a malicious AI provider endpoint. By setting this endpoint to an internal or link-local URI, the attacker can force the server to perform requests on their behalf. Subsequently, the attacker interacts with the AgentsController to reassign the built-in Roslin agent to utilize the newly created, attacker-controlled provider.\nWhen an AI interaction is initiated through the application, the backend server performs an HTTP/HTTPS request to the attacker-defined URL. The application fails to sanitize or restrict the destination host, allowing for interaction with internal infrastructure. A critical feature of this SSRF vulnerability is the observability of the target response: if the forged request results in a non-2xx HTTP status code, the application captures the target's response body and reflects it back to the attacker's browser session via ActionCable/Turbo Stream error messages. This mechanism bypasses the blind nature of typical SSRF, transforming it into a readable SSRF attack.\nThe attack is highly effective for probing internal network topology, enumerating internal services, or exfiltrating cloud metadata tokens. The lack of validation on the destination URL or protocol schema permits the attacker to bypass network segmentation and interact with services reachable only from the application server's perspective. The impact is elevated by the persistent nature of the configuration, as the attacker's modification to the Roslin agent configuration remains in place, allowing for continued exploitation of the server-side request functionality without further authentication bypass steps."
}