REDHAT-BUG-2523431: SSRF
galaxyng is a Pulp plugin powering Ansible Galaxy and Ansible Automation Platform Private Automation Hub. A server-side request forgery (SSRF) exists in the namespace avatar download path.
In galaxyng/app/api/v3/serializers/namespace.py, avatarurl is a DRF URLField. That field validates URL syntax and scheme (http/https) only. It does not resolve the hostname or filter private, loopback, link-local, or cloud-metadata addresses. On namespace create, downloadlogo is always True. On update, downloadlogo is True whenever avatarurl is present. The serializer then dispatches a Pulp task that calls downloadavatar() in galaxyng/app/tasks/namespaces.py.
downloadavatar() builds an aiohttp session with ClientTimeout(total=None, sockconnect=600, sockread=600) and passes the user-supplied URL to pulpcore HttpDownloader with no address restriction and no redirect-target revalidation. The Pulp worker therefore requests whatever address the publisher supplied, including RFC1918, 127.0.0.0/8, 169.254.0.0/16, and cloud metadata endpoints.
The SSRF is blind: the response is stored only if it passes image validation (PIL ImageField or SVG). Non-image bodies are discarded, so this is not direct credential exfiltration. The attacker still gets a binary oracle via namespace avatarsha256 (updated vs unchanged), which is enough to enumerate reachable internal IPs and ports from the worker's network. The total=None timeout also lets a slow or hanging target pin a worker, which is a denial-of-service angle.
Privilege required is an authenticated user with galaxy.changenamespace or galaxy.addnamespace. In community Galaxy that includes a user's own namespace.
Affected: galaxyng (verified on current main, HEAD 2bc7189 at clone time). No upstream fix identified in the examined tree. Reporter: Arpit Jain (GitHub arpitjain099), independent security researcher. PSIRT ticket: PSIRTSUPT-22101 Distinct from GHSA-hc3x-6pf5-pmj3 (legacy role import path).
Affected Software
Event History
Frequently Asked Questions
Who can trigger the outbound request?
A publisher who can supply an avatar_url while creating or updating a namespace can cause a Pulp worker to request that URL. The request can target private, loopback, link-local, and cloud-metadata address ranges.
Are namespace creation and updates both affected?
Yes. Namespace creation always enables avatar downloading, and an update enables it whenever avatar_url is present.
Can this be used to read arbitrary internal service responses?
The SSRF is blind. Responses are retained only when they pass image validation as an image or SVG; non-image response bodies are discarded.
Do redirects receive the same destination checks as the original URL?
No. The download path has no address restriction and does not revalidate redirect targets, so a supplied URL can redirect the worker to another address.