REDHAT-BUG-2517885: SSRF
The /api/devfile/ and /api/devfile/samples/ endpoints in the OpenShift console (bridge) are registered with handleFunc() directly, without being wrapped in authHandler or authHandlerWithUser like every other /api/ route (pkg/server/server.go:347-348).
DevfileHandler decodes an arbitrary JSON body and passes DevfileContent to devfile.ParseDevfileAndValidate(parser.ParserArgs{Data: ..., HTTPTimeout: &httpTimeout}). The devfile library resolves parent.uri, kubernetes.uri, and remote plugin references over HTTP from the console pod. No request-body size limit is applied (MaxBytesReader is absent).
An unauthenticated attacker on the OpenShift Route can send a crafted devfile payload with parent.uri pointing to internal services (e.g. cloud metadata endpoints, etcd, kubelets). The response body is reflected in the parser error string returned to the client, yielding partial-read SSRF. Repeated large-body POSTs without Content-Length cause unbounded memory growth (DoS).
Tested and reproduced on OCP 5.0 nightly cluster.
Upstream: https://github.com/openshift/console File: pkg/server/server.go:347-348, pkg/devfile/handler.go:37-67
Affected Software
Event History
Frequently Asked Questions
Does an attacker need OpenShift authentication to exploit this?
No. The affected endpoints are registered without the console authentication wrappers, so an unauthenticated attacker who can reach the OpenShift Route can submit a crafted devfile payload.
What network access is required for exploitation?
The attacker needs access to the OpenShift console Route. The resulting outbound requests originate from the console pod, allowing references to services that are reachable from that pod, including internal endpoints.
What data can be exposed through the server-side request behavior?
A referenced parent, Kubernetes, or remote plugin URI can cause the devfile library to fetch content over HTTP. Parser errors returned to the client can reflect part of the fetched response body, resulting in partial-read exposure.
Is denial of service possible as well as SSRF?
Yes. The handler has no request-body size limit; repeated large POST requests without a Content-Length can cause unbounded memory growth.