PT-2026-66492 · Malach It · Boruta
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
malach-it Boruta versions 2.3.2 through 2.3.6
Description
An unauthenticated remote attacker can cause the OAuth/OpenID authorization server to issue outbound HTTP requests to arbitrary URIs, including internal services and cloud metadata endpoints. This occurs because three code paths fetch remote URIs supplied by the requester without sufficient validation. Specifically, the
fetch unsigned request/1 function dereferences the request uri parameter, the parse registration params/2 function dereferences the jwks uri supplied in an OpenID Connect dynamic client registration request, and the refresh jwk from jwks uri/1 function refreshes the stored jwks uri for an existing client. The validation is insufficient as it only checks if the URI parses with a scheme, failing to require HTTPS, enforce host or IP allowlists, reject loopback or private IP ranges after DNS resolution, cap response size, or constrain redirects.Recommendations
Update malach-it Boruta to version 2.3.7 or later.
Restrict the network egress of the Boruta host to prevent the OAuth/OpenID authorization server from reaching loopback, private, link-local, multicast, or cloud metadata addresses.
Disable application routes for OAuth
request uri dereferencing and OpenID Connect dynamic client registration, or restrict dynamic client registration to trusted callers.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Boruta