# SSRF allowlist bypass forwarding credentials

Proxy or fetcher that attaches auth headers to attacker-influenced hosts after a weak allowlist check

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; one confirmed bounty: $5,000; latest 2026-09-30. Updated 2026-11-02._

## How it works
A server-side fetcher or proxy is meant to reach only approved hosts, so it checks the destination against an allowlist. The check and the actual connection disagree about which host is being contacted: the allowlist reads one part of the URL (a path segment, a prefix, a pre-expansion string) while the transport resolves another. Because the proxy also injects the caller's credentials (Authorization header, OAuth token, environment values) into the outbound request, any host that slips past the check receives those credentials. The broken assumption is that "the host I validated" equals "the host I connect to."

## Where it shows up
- Proxy endpoints that add an `Authorization` header on behalf of the user, e.g. `/proxy/<host>/...` patterns [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- Allowlist checks done on a path segment or string prefix rather than the parsed, resolved host [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- Local-path normalization helpers (`expandvars`, `expanduser`, backslash fixing) applied to remote URLs [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md)
- Protocol/scheme safety checks that run before variable expansion [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md)
- Parallel transports (HTTP/1 vs HTTP/2) where one path forwards `lookup`, proxy agent, or agent config and the other does not [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3pq3-5fj3-cg6v.md)
- Any fetcher whose low-level connect call receives a different options object than the one policy was applied to [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3pq3-5fj3-cg6v.md)

## How to review
Find the exact host string that policy validated and the exact host the socket connects to; they must be identical after parsing and expansion. Check that: the allowlist compares a fully parsed hostname, not a substring or path piece; no `expandvars`/`expanduser` runs on network-bound URLs; scheme checks run after any expansion; and every transport path forwards the same `lookup`, proxy, and agent settings. If credentials are attached, ask whether the validated host is the only possible recipient.

## How finders spotted it
- Noticed a `/proxy/compute.googleapis.com/` URL shape during OAuth exploration, suspected SSRF, confirmed authenticated output, then fuzzed the host allowlist and found path confusion [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- After a fix, saw `*.google.com` newly allowed and hunted a 3xx open redirect to re-reach the proxy [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- Read `polish_url()` as a local-path helper and noticed it was applied to remote clone URLs, while `expand_vars=False` was used only for the local repo path [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md)
- Diffed the HTTP/1 adapter (wraps `lookup`, calls `setProxy()`) against the HTTP/2 transport, which passed only `http2Options` to `http2.connect()` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3pq3-5fj3-cg6v.md)

## Variants seen
- Path-confusion allowlist bypass on a credential-forwarding proxy [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- Open-redirect on an allowlisted domain used to bounce back to the proxy [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md)
- Environment-variable expansion leaking secrets into an attacker-named host [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md)
- Pre-expansion protocol check bypassed via a controlled env var reaching `ext::` transport [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md)
- HTTP/2 adapter dropping DNS `lookup` and proxy controls, reaching loopback/internal [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3pq3-5fj3-cg6v.md)

## Impact and severity
E1 chained to full GCP project takeover via leaked `cloud-platform` OAuth tokens, raised by combining allowlist bypass, open redirect, and a CSRF bypass [E1](https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md). E2 leaked server secrets such as AWS keys to an attacker host [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md). E3 let user-influenced URLs reach internal or loopback destinations SSRF policy should block [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3pq3-5fj3-cg6v.md). Severity rises with the privilege of the forwarded credential and how far the reachable network extends.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **axios (npm)** >= 1.13.0, < 1.20.0, fixed in 1.20.0: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls (CVE-2026-101898). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-3pq3-5fj3-cg6v.md. Fix: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
- **GitPython (pip)** < 3.1.52, fixed in 3.1.52: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL (CVE-2026-67322). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md. Fix: https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2
- **Vertex AI Workbench** (/aipn/v2/proxy/) (version not stated): Client-Side SSRF to Google Cloud Project Takeover [Google VRP]. Report: https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-geekycat-in-client-side-ssrf-to-google-cloud-project-takeover.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-rwj8-pgh3-r573.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-3pq3-5fj3-cg6v.md