You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/10 21:22:11 UTC

[I] [Studio][Security] Block the AWS IMDS IPv6 endpoint in data source tests [rocketmq-dashboard]

youngkermit8-coder opened a new issue, #1509:
URL: https://github.com/apache/rocketmq-dashboard/issues/1509

   ## Bug Report
   
   ### Runtime environment
   
   - RocketMQ Dashboard branch: `rocketmq-studio`
   - JDK: 21
   
   ### Description
   
   `SettingsService.isAllowedDataSourceHost()` protects the server-side data-source connection test from cloud metadata endpoints by rejecting link-local addresses. This blocks the usual IPv4 IMDS endpoint (`169.254.169.254`), but the AWS IMDS IPv6 endpoint (`fd00:ec2::254`) passes the current checks.
   
   On JDK 21, `InetAddress` reports all of the following as `false` for `fd00:ec2::254`:
   
   - `isAnyLocalAddress()`
   - `isLinkLocalAddress()`
   - `isLoopbackAddress()`
   - `isSiteLocalAddress()`
   
   As a result, a data-source test URL such as `http://[fd00:ec2::254]/latest/meta-data/` proceeds to the server-side HTTP client instead of being rejected as a metadata address.
   
   AWS documents `[fd00:ec2::254]` as the IPv6 endpoint for the EC2 Instance Metadata Service:
   
   - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
   - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-limiting-access.html
   
   ### Expected behavior
   
   Both documented AWS IMDS endpoints must be rejected by the data-source URL guard, while ordinary internal Prometheus addresses remain allowed for on-premise deployments.
   
   ### Proposed scope
   
   - Detect the exact IPv6 IMDS address using its resolved 16-byte representation so alternate IPv6 text forms cannot bypass the check.
   - Add a regression test for `http://[fd00:ec2::254]/latest/meta-data/`.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Security] Block cloud metadata endpoints missed by Java address checks [rocketmq-dashboard]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] commented on issue #1509:
URL: https://github.com/apache/rocketmq-dashboard/issues/1509#issuecomment-5737754066

   This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Security] Block cloud metadata endpoints missed by Java address checks [rocketmq-dashboard]

Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.

RockteMQ-AI commented on issue #1509:
URL: https://github.com/apache/rocketmq-dashboard/issues/1509#issuecomment-5248195046

   **Issue Evaluation**
   
   Category: `bug` | Status: **Confirmed** (Security)
   
   This is a valid SSRF bypass vulnerability. The `isAllowedDataSourceHost()` guard relies on Java's `InetAddress` classification (any-local, link-local, loopback, site-local), which does not cover documented cloud metadata endpoints:
   
   - **AWS EC2 IMDS IPv6:** `fd00:ec2::254` — not classified as link-local by Java
   - **Alibaba Cloud ECS metadata:** `100.100.100.200` — not classified as link-local or site-local by Java
   
   **Root Cause:** The SSRF guard uses Java address category checks instead of an explicit blocklist for known cloud metadata endpoints.
   **Impact:** Server-side data-source connection test can reach cloud instance metadata services, potentially exposing IAM credentials and instance identity documents.
   **Severity:** High — security vulnerability with potential for credential exposure
   
   **Note:** The referenced `SettingsService.isAllowedDataSourceHost()` code resides on the `rocketmq-studio` branch. Verification was based on the detailed issue description and the documented metadata endpoint addresses.
   
   An automated fix proposal can be generated once the `rocketmq-studio` branch is accessible. Reply `/approve` to proceed with PR generation when the branch is available.
   
   ---
   *Automated evaluation by RockteMQ-AI*
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Security] Block cloud metadata endpoints missed by Java address checks [rocketmq-dashboard]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] closed issue #1509: [Studio][Security] Block cloud metadata endpoints missed by Java address checks
URL: https://github.com/apache/rocketmq-dashboard/issues/1509


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org