# SSRF via remote content import

Import, cleaner, or attachment pipelines that fetch attacker-supplied URLs or seed framework magic setters

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 2 confirmed bounties: $1,000 and $10,000; latest 2026-06-18. Updated 2026-10-24._

## How it works
An import, cleaner, or attachment pipeline accepts user-supplied content and, while processing it, makes a server-side request to a URL the user controls. The assumption that breaks is that import data is "just data": the sanitizer strips obvious fields but misses attributes that a framework treats as fetch instructions. CarrierWave's `remote_*_url` setters and Nodemailer's `raw:{href}` are examples where a plain-looking attribute triggers a server-side download. The server then fetches internal addresses or local files on the attacker's behalf.

## Where it shows up
- Import/export sanitizers with denylists of model attributes; check whether every attribute mapping to a framework magic setter is covered.
- Uploader mounts (`mount_uploader`, CarrierWave `remote_*_url`, `remote_*_request_header`) reachable from imported records.
- Library code that enforces a policy per-node via constructor options; look for a node built without re-passing the flags.
- Image proxies or fetch endpoints that follow arbitrary URLs without restricting internal hosts.
- Internal renderers (headless/PhantomJS banner services) whose URL parameter accepts `file://`.

## How to review
The invariant: any server-side fetch triggered by user content must be constrained to an allowlist of schemes and hosts, and every code path that builds a fetch must carry the same access policy. Concretely: enumerate every attribute on imported models that maps to a framework setter and confirm the sanitizer removes it; for per-node policy libraries, audit every node-construction site for one that omits the flags; for proxies, verify internal ranges and non-HTTP schemes are rejected, and check chained internal services separately.

## Variants seen
- Import sanitizer missing CarrierWave seed attributes, triggering server-side download [E1](https://bugbountylibrary.com/r/h1%3A826361.md).
- Message-level `raw` option bypassing `disableFileAccess`/`disableUrlAccess` because the raw root node was built without the flags [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p6gq-j5cr-w38f.md).
- Image-fetch endpoint following arbitrary URLs, chained to an internal banner renderer accepting `file://` [E3](https://bugbountylibrary.com/r/h1%3A826097.md).

## Impact and severity
Led to internal network access, local file reads, and data exfiltration through delivered messages or attachments. Severity rises when the fetch response is returned or attached, and when a second internal service widens reach beyond the first SSRF [E3](https://bugbountylibrary.com/r/h1%3A826097.md). Median bounty 5500 across three reports.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A826361.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-p6gq-j5cr-w38f.md
- E3: https://bugbountylibrary.com/r/h1%3A826097.md