V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2
disclosure@vulncheck.com
https://github.com/vlang/v/issues/27945
disclosure@vulncheck.com
https://github.com/vlang/v/pull/27947
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-n…
disclosure@vulncheck.com