Description

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-05T10:16:42.567Z",
  "pubdate": "2026-09-05T10:16:42.567Z",
  "executiveSummary": "Sim versions prior to 0.8.14 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability leading to an authentication bypass. The issue stems from insecure URL prefix matching logic used to classify tool requests as 'internal'.\nBy failing to perform scheme normalization before validation, the application allows authenticated workflow authors to masquerade external requests as internal traffic. This flaw enables attackers to circumvent external URL validation controls and reach restricted endpoints.\nThe primary risk involves unauthorized access to sensitive internal API routes, such as POST /api/function/execute. Successful exploitation allows an attacker to execute arbitrary functions or interact with internal services that were intended to be protected from direct user-controlled input.\nThe vulnerability requires an authenticated attacker with workflow authoring privileges. Because the system automatically mints internal authentication tokens for requests perceived as 'internal', the attacker gains the ability to perform actions with elevated permissions that should otherwise be restricted to legitimate internal components.",
  "technicalDetails": "The root cause of the vulnerability lies in the implementation of a client-side URL validation mechanism that relies on prefix matching without adequate scheme normalization. In Sim versions prior to 0.8.14, the software attempts to distinguish between external tool requests and internal API calls by checking if the destination URL begins with a specific prefix, such as '/api/'.\nBecause the validation logic does not normalize the request scheme (e.g., ensuring standard URI parsing before prefix comparison), the application fails to distinguish between intended internal paths and attacker-supplied input that mimics these paths. An authenticated workflow author can leverage this by providing a path string that starts with '/api/' within an HTTP block.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious workflow definition containing an HTTP block. 2) The attacker inserts a target path starting with '/api/', for example, '/api/function/execute'. 3) The validation engine incorrectly identifies this string as an 'internal' resource due to the flawed prefix matching logic. 4) The system, believing the request is internal, skips standard SSRF validation protocols. 5) The system automatically mints an internal authentication token and attaches it to the request. 6) The request is then dispatched to the internal API endpoint. 7) The backend service processes the request as a legitimate internal call, executing the function or command requested by the attacker.\nThis vulnerability effectively elevates the privileges of the workflow author, allowing them to interact with internal-only endpoints. The lack of scheme normalization is critical here, as the application assumes that any request satisfying the prefix condition is inherently trustworthy. By bypassing the SSRF protection, the attacker can leverage the application's own infrastructure to perform actions that are traditionally blocked by security policies. The impact is significant, as it grants attackers the capability to trigger internal function execution, potentially leading to remote code execution (RCE) or unauthorized data access depending on the functionality exposed by the internal API."
}