# URL concatenation host override

User input glued into a base URL lets @, //, or absolute URLs swap the host

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2024-01-31. Updated 2026-10-23._

## How it works
Code builds an outbound URL by string concatenation: `baseUrl + path`, or `"https://" + host + path` with no separator. The assumption is that the trusted base still governs where the request goes. URL syntax breaks that: when the appended value starts the authority (no `/` separator), an `@` turns the trusted host into userinfo and the real host becomes whatever follows; a leading `//host` or `http://host` is parsed as a new authority. The validator and the HTTP client may also parse differently, so a value that looks safe resolves elsewhere at request time.

## Where it shows up
- `baseUrl + path` or `"https://" + host + path` with no separator or encoding [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056.md)
- A client that merges origin with a user pathname without checking it is relative [E4](https://bugbountylibrary.com/r/h1%3A1663788.md)
- Requests carrying credentials or signed headers to whatever host results [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056.md)
- A validator (allowlist, regex) separate from the client that connects [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135.md)

## How to review
Trace every user-controlled value into a URL builder. The invariant: after construction, the parsed scheme and host must equal the intended trusted values, and the user value must occupy only the path or query component. Concretely, parse the final URL and assert `uri.getHost()` equals the expected host and `uri.getScheme()` the expected scheme before sending. Check the path is encoded or built with a proper URI builder, not concatenation. Confirm the same parser is used for validation and for the request.

## Variants seen
- `@` in path turns host into userinfo, redirecting to attacker host [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135.md)[E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056.md)
- Protocol-relative `//host` or absolute `http://host` pathname overrides origin [E4](https://bugbountylibrary.com/r/h1%3A1663788.md)
- URL-decoded path segment smuggles `?`/`&`/`=` query params (adjacent: query injection) [E2](https://bugbountylibrary.com/r/h1%3A878779.md)

## Impact and severity
Led to full-read SSRF reaching internal hosts [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135.md), theft of admin JWTs via attached Authorization headers [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056.md), and backend requests redirected to arbitrary hosts including loopback [E4](https://bugbountylibrary.com/r/h1%3A1663788.md). Severity rises when the client forwards credentials or signed headers [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056.md), when the request is pre-auth reachable [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135.md), or when a parser differential defeats an allowlist.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-abusing-functionality-to-exploit-a-super-ssrf-in-jira-server-cve-2022-26135.md
- E2: https://bugbountylibrary.com/r/h1%3A878779.md
- E3: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056.md
- E4: https://bugbountylibrary.com/r/h1%3A1663788.md