You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "Aias00 (via GitHub)" <gi...@apache.org> on 2026/08/18 04:53:16 UTC
[I] security: restrict proxy reload targets to trusted endpoints [rocketmq-dashboard]
Aias00 opened a new issue, #2338:
URL: https://github.com/apache/rocketmq-dashboard/issues/2338
## Problem
An administrator can register any syntactically valid `host:port` through the proxy compatibility API, then invoke proxy configuration reload. The service posts to `http://<address>/admin/reloadConfig` without a resolved-address policy or a binding to known RocketMQ proxy endpoints. This is an administrator-scoped blind SSRF.
## Scope
- Bind reload targets to trusted, configured proxy endpoints.
- Reject arbitrary dynamic target registration for reload execution.
- Add regression coverage for loopback and non-cluster target rejection.
## Impact
Server-side outbound requests to attacker-selected destinations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] security: restrict proxy reload targets to trusted endpoints [rocketmq-dashboard]
Posted by "Aias00 (via GitHub)" <gi...@apache.org>.
Aias00 commented on issue #2338:
URL: https://github.com/apache/rocketmq-dashboard/issues/2338#issuecomment-5323900925
Thanks for the review. This report targets the `rocketmq-studio` branch, not the repository default branch. The affected code is present there:
- `server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyCompatController.java` exposes `POST /api/proxy/addProxyAddr.do`.
- `server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyController.java` exposes `POST /api/proxies/config/reload`.
- `ProxyAddressService.reloadConfig` constructs `http://<registered-address>/admin/reloadConfig` and performs the outbound POST. The prior registration validation only checked `host:port` syntax, so an administrator could register and invoke an arbitrary reachable target.
The fix is available in PR #2340, based on `rocketmq-studio`: it resolves reload targets from the selected cluster's discovered Proxy endpoints instead of the mutable compatibility-address registry. All CI checks are passing.
Please evaluate the report and PR against `rocketmq-studio`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] security: restrict proxy reload targets to trusted endpoints [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #2338:
URL: https://github.com/apache/rocketmq-dashboard/issues/2338#issuecomment-5326021447
Thanks for the clarification, @Aias00. I've verified the code on the `rocketmq-studio` branch and can confirm this is a valid SSRF vulnerability.
**Verified on `rocketmq-studio` branch:**
- `ProxyAddressService.reloadConfig()` accepts any registered `host:port` and POSTs to `http://<addr>/admin/reloadConfig`
- The `proxyAddrs` set can be populated via the API, allowing arbitrary target registration
- No validation that the target belongs to a known RocketMQ proxy cluster
**Category:** Security (SSRF) | **Severity:** MEDIUM (administrator-scoped)
**Status:** Confirmed ✓
This should bind reload targets to a trusted, pre-configured proxy allowlist rather than accepting dynamic registration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] security: restrict proxy reload targets to trusted endpoints [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #2338:
URL: https://github.com/apache/rocketmq-dashboard/issues/2338#issuecomment-5418733970
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] security: restrict proxy reload targets to trusted endpoints [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #2338:
URL: https://github.com/apache/rocketmq-dashboard/issues/2338#issuecomment-5323888377
**Issue Evaluation**
Category: (security) | Status: **Needs Info**
Thank you for reporting this potential SSRF concern. However, after reviewing the current codebase on the branch, I could not find the described functionality:
- No endpoint or proxy configuration reload mechanism exists in or .
- The interface only exposes — there is no HTTP-based reload call.
- The endpoint adds addresses to an in-memory list but does not trigger outbound HTTP requests.
Could you clarify:
- [ ] Which version/tag or branch contains the described proxy reload feature?
- [ ] Is this based on a planned PR or a fork-specific change?
Without the relevant code path, I cannot verify the reported vulnerability.
---
*Automated evaluation by RockteMQ-AI*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] security: restrict proxy reload targets to trusted endpoints [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #2338: security: restrict proxy reload targets to trusted endpoints
URL: https://github.com/apache/rocketmq-dashboard/issues/2338
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org