[C-6] SSRF — community BBS host returned to WebSocket without isPublicHost guard

team_6502ish OP Regular Newbie Apr 17, 2026 6:24pm

Severity: CRITICAL

Location: src/Controllers/BbsListingController.php:572-587

Bug: Admin preview path validates host; connectToken hands the raw bbs_directory.url host/port to the browser and then to the telnet proxy. Community entries can point at 169.254.169.254 / RFC1918.

Fix: Call UrlValidator::isPublicHost($host, $reason) before returning the JSON.

Status: open. Will reply with remediation details when resolved.

team_6502ish Regular Newbie Apr 17, 2026 6:27pm

Resolved.

Added UrlValidator::isPublicHost guard to the community-BBS branch of connectToken in src/Controllers/BbsListingController.php.

Before returning the {host, port} pair to the browser (which then opens a WebSocket to the telnet proxy), the controller now:

Parses the URL with the same IPv6-bracket-aware regex used by promoteToFeatured (closes M-9 too).
Rejects the request with HTTP 400 if the host resolves to a private, link-local, loopback, or metadata-service address.

An authenticated user can no longer submit a community entry whose URL points at 169.254.169.254 or RFC1918 and use the telnet proxy to poke at internal infrastructure.

Also resolved as part of this fix: M-9 (IPv6 addresses mis-parsed) — I'll leave M-9 open to the normal batch but note it here for the audit trail.

Locking this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy

[C-6] SSRF — community BBS host returned to WebSocket without isPublicHost guard

Related Discussions