Security: Fix SSRF vulnerability in media conversion endpoints

[Yunkaiwjs]

Summary

This PR fixes a Server-Side Request Forgery (SSRF) vulnerability in the media conversion endpoints (/api/:session/media/convert/voice and /api/:session/media/convert/video) that allowed authenticated users to make arbitrary HTTP requests to internal services.

Vulnerability Details

CVSS: 7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE: CWE-918 (Server-Side Request Forgery)

The fetchBuffer() function in src/utils/fetch.ts performed no validation on user-provided URLs, allowing authenticated attackers to:

• Access internal services (localhost, private IP ranges)
• Read cloud metadata endpoints (169.254.169.254)
• Bypass certificate validation
• Exploit redirect chains

Changes

Security Improvements

1. URL Validation - Added validateUrl() function to check:

   • Scheme whitelist (http/https only)
   • Private IP ranges (10.x, 192.168.x, 172.16-31.x, 127.x)
   • Blocked hosts (localhost, cloud metadata endpoints)
   • IPv6 private ranges

2. Certificate Validation - Changed from InsecureHttpsAgent (rejectUnauthorized: false) to SecureHttpsAgent (rejectUnauthorized: true)

3. Redirect Protection - Set maxRedirects: 0 to prevent SSRF via redirect chains

4. Timeout - Added 30-second timeout to prevent hanging requests

Code Changes

• Modified src/utils/fetch.ts:
  • Added validateUrl() function with comprehensive checks
  • Added isPrivateIP() helper function
  • Replaced InsecureHttpsAgent with SecureHttpsAgent
  • Added maxRedirects: 0 and timeout: 30000

Testing

Tested with the following scenarios:

• Blocks localhost (127.0.0.1, localhost)
• Blocks private IPs (10.x, 192.168.x, 172.16-31.x)
• Blocks cloud metadata (169.254.169.254)
• Blocks IPv6 private ranges (fc00::/7, ::1)
• Allows public URLs (https://example.com)
• Rejects invalid schemes (file://, ftp://)
• Enables certificate validation
• Prevents redirect-based bypasses

Impact

This fix prevents authenticated users from:

• Accessing internal services and private networks
• Extracting cloud credentials from metadata endpoints
• Performing port scanning of internal infrastructure
• Bypassing certificate validation on internal HTTPS services

Backward Compatibility

Warning - Breaking Change: This fix will reject URLs pointing to private IP ranges and localhost. If your application legitimately needs to fetch from internal services, you may need to:

1. Add a configuration option to whitelist specific internal URLs
2. Use a separate fetch function for trusted internal requests
3. Implement a proxy service for internal resource access

References

• CWE-918: Server-Side Request Forgery (SSRF)
• OWASP SSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html