## Summary

The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request.

This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints.

## Severity

Bypass of cloud metadata SSRF protection for all blocked IPs

## Required Permissions

Exploitation requires GraphQL schema permissions for:
- Edit assets in the `<VolumeName>` volume
- Create assets in the `<VolumeName>` volume

These permissions may be granted to:
- Authenticated users with appropriate GraphQL schema access
- Public Schema (if misconfigured with write permissions)

---

## Technical Details

### Vulnerable Code Flow

The code at `src/gql/resolvers/mutations/Asset.php` performs two separate DNS lookups:

```php
// VALIDATION PHASE: First DNS resolution at time T1
private function validateHostname(string $url): bool
{
$hostname = parse_url($url, PHP_URL_HOST);
$ip = gethostbyname($hostname); // DNS Lookup #1 - Returns safe IP

if (in_array($ip, [
'169.254.169.254', // AWS, GCP, Azure IMDS
'169.254.170.2', // AWS ECS metadata
'100.100.100.200', // Alibaba Cloud
'192.0.0.192', // Oracle Cloud
])) {
return false; // Check passes - IP looks safe
}
return true;
}

// ... time gap between validation and request ...

// REQUEST PHASE: Second DNS resolution at time T2 (inside Guzzle)
$response = $client->get($url); // DNS Lookup #2 - Guzzle resolves DNS AGAIN
// Now returns 169.254.169.254!
```

### Root Cause

Two separate DNS lookups occur:
1. **Validation**: `gethostbyname()` in `validateHostname()`
2. **Request**: Guzzle's internal DNS resolution via libcurl

An attacker controlling a DNS server can return different IPs for each query.

### Bypass Mechanism

```
+-----------------------------------------------------------------------------+
| Attacker's DNS Server: evil.attacker.com |
+-----------------------------------------------------------------------------+
| Query 1 (Validation - T1): |
| Request: A record for evil.attacker.com |
| Response: 1.2.3.4 (safe IP, TTL: 0) |
| Result: Validation PASSES |
+-----------------------------------------------------------------------------+
| Query 2 (Guzzle Request - T2): |
| Request: A record for evil.attacker.com |
| Response: 169.254.169.254 (metadata IP, TTL: 0) |
| Result: Request goes to blocked IP -> CREDENTIALS STOLEN |
+-----------------------------------------------------------------------------+
```

---

## Target Endpoints via DNS Rebinding

DNS rebinding allows access to all blocked IPs:

| Target | Rebind To | Impact |
|--------|-----------|--------|
| **AWS IMDS** | `169.254.169.254` | IAM credentials, instance identity |
| **AWS ECS** | `169.254.170.2` | Container credentials |
| **GCP Metadata** | `169.254.169.254` | Service account tokens |
| **Azure Metadata** | `169.254.169.254` | Managed identity tokens |
| **Alibaba Cloud** | `100.100.100.200` | Instance credentials |
| **Oracle Cloud** | `192.0.0.192` | Instance metadata |
| **Internal Services** | `127.0.0.1`, `10.x.x.x` | Internal APIs, databases |

---

### Attack Scenario

1. Attacker sets up DNS server with alternating responses
2. Attacker sends mutation with `url: "http://evil.attacker.com/latest/meta-data/"`
3. First DNS query returns safe IP (e.g., `1.2.3.4`) → validation passes
4. Second DNS query returns metadata IP (`169.254.169.254`) → request to metadata
5. Attacker retrieves credentials from ANY cloud provider
6. **Attacker can now achieve code execution by creating new instances with their SSH key**

---

## Remediation

### Fix: DNS Pinning with CURLOPT_RESOLVE

Pin the DNS resolution - use the same resolved IP for both validation and request:

```php
private function validateHostname(string $url): bool
{
$hostname = parse_url($url, PHP_URL_HOST);

// Resolve once
$ip = gethostbyname($hostname);

// Validate the resolved IP
if (in_array($ip, [
'169.254.169.254', '169.254.170.2',
'100.100.100.200', '192.0.0.192',
])) {
return false;
}

// Store for later use
$this->pinnedDNS[$hostname] = $ip;

return true;
}

// When making the request - CRITICAL: Use pinned IP
protected function makeRequest(string $url): ResponseInterface
{
$hostname = parse_url($url, PHP_URL_HOST);
$ip = $this->pinnedDNS[$hostname] ?? null;

$options = [];
if ($ip) {
// Force Guzzle/curl to use the SAME IP we validated
$options['curl'] = [
CURLOPT_RESOLVE => [
"$hostname:80:$ip",
"$hostname:443:$ip"
]
];
}

return $this->client->get($url, $options);
}
```

### Alternative: Single Resolution with Immediate Use

```php
// Resolve to IP and use IP directly in URL
$ip = gethostbyname($hostname);

if (in_array($ip, $blockedIPs)) {
return false;
}

// Make request directly to IP with Host header
$client->get("http://$ip" . parse_url($url, PHP_URL_PATH), [
'headers' => [
'Host' => $hostname
]
]);
```

### Additional Mitigations

| Mitigation | Description |
|------------|-------------|
| DNS Pinning (CURLOPT_RESOLVE) | Force same IP for validation and request |
| Single IP-based request | Use resolved IP directly in URL |
| Implement IMDSv2 | Requires token header (infrastructure-level) |
| Network egress filtering | Block metadata IPs at network level |

---

## Resources

- https://github.com/craftcms/cms/commit/a4cf3fb63bba3249cf1e2882b18a2d29e77a8575
- [GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc) - Original SSRF vulnerability (CVE-2025-68437)
- [DNSrebinder](https://github.com/mogwailabs/DNSrebinder) - Lightweight Python DNS server for testing DNS rebinding vulnerabilities; responds with legitimate IP for first N queries, then rebinds to target IP
- [Singularity DNS Rebinding Tool](https://github.com/nccgroup/singularity)
- [rbndr DNS Rebinding Service](https://github.com/taviso/rbndr)
- [DNS Rebinding Attacks Explained](https://unit42.paloaltonetworks.com/dns-rebinding/)
- [CURLOPT_RESOLVE Documentation](https://curl.se/libcurl/c/CURLOPT_RESOLVE.html)
- OWASP SSRF Prevention Cheat Sheet

CWE-367