Description

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:48.967Z",
  "pubdate": "2026-09-04T15:17:48.967Z",
  "executiveSummary": "Jina AI reader is affected by a Server-Side Request Forgery (SSRF) vulnerability due to insufficient validation of redirected requests. This flaw allows unauthorized actors to bypass initial security checks by leveraging subsequent HTTP redirects to target internal network resources or cloud metadata services.\nThe vulnerability occurs because URL validation logic is restricted to the primary request only, failing to enforce security policies on redirected hops. This failure enables attackers to force the server to perform arbitrary requests against protected infrastructure that would otherwise be unreachable from the public internet.\nThe impact is significant, potentially leading to unauthorized data exfiltration, exposure of cloud environment credentials, or interaction with internal services behind the firewall. Successful exploitation requires an attacker to control a remote server capable of issuing HTTP redirects to internal-only endpoints. There are no authentication requirements mentioned, as the server acts as an open proxy for the attacker's malicious payloads. This poses a high risk to organizations relying on internal network isolation as a primary security control.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete implementation of input validation and request handling logic within the Jina AI reader service. While the application validates the user-supplied URL during the initial request phase, it fails to propagate or re-apply these validation constraints to the underlying HTTP client handling subsequent location header responses.\nThe exploitation flow proceeds as follows: First, the attacker provides an input URL controlled by the attacker to the Jina AI reader service. The service performs a validation check on this initial URL and confirms it is 'safe' (e.g., a public domain). Once the connection is initiated, the attacker's server responds with a 3xx redirect status code, pointing the request toward an internal target such as 169.254.169.254 (the cloud metadata service) or a local management interface (e.g., http://localhost:8080).\nBecause the Jina AI reader does not implement a recursive validation or a blocklist/allowlist check on the final target of a redirect, the HTTP client transparently follows the redirect and performs the GET request to the sensitive internal resource. The server then receives the response body from the internal resource and returns it to the attacker, effectively granting the attacker read access to protected network segments.\nThis vulnerability is particularly dangerous in cloud-hosted environments. By redirecting to the cloud instance metadata service, an attacker can extract sensitive information such as IAM roles, security credentials, and environment-specific configuration details. Furthermore, the attacker can use the server as a proxy to probe internal APIs, perform reconnaissance on internal network topologies, or exploit services that implicitly trust the local host or internal network traffic. The vulnerability demonstrates a failure to adhere to secure design principles regarding request handling, specifically the 'time-of-check to time-of-use' (TOCTOU) problem inherent in managing HTTP redirection chains. Without strict host filtering at the point of request execution, the application remains vulnerable to being abused for unauthorized data retrieval from private network zones."
}