image_url is unvalidated and the image download is uncapped #79

New issue

Open

opened 2026-08-22 10:59:25 +00:00 by a73x · 0 comments

a73x commented

2026-08-22 10:59:25 +00:00

(Migrated from git.a73x.sh)

From the pre-launch security audit (finding API-5, ranked #4 of the outstanding set).

image_url on VM create is neither validated nor size-capped. It is SSRF-shaped, but
self-directed: a tenant may only place VMs on their own hosts, so the request originates
from the tenant's own host, not the control plane. The genuinely live half is the
unbounded download — a create can point at an arbitrarily large URL and the host
fetches it with no cap.

Fix. Validate the scheme/host, and cap the fetched image size (fail the create past
a ceiling rather than filling the host's disk). Authenticated-tenant only; Low–Medium.

Migrated from git-collab issue 4636c0b9e91e6710f9cbc54fc92354c019bc3ec1.

Original author: a73x dev@a73x.sh.

From the pre-launch security audit (finding API-5, ranked #4 of the outstanding set). `image_url` on VM create is neither validated nor size-capped. It is SSRF-shaped, but self-directed: a tenant may only place VMs on their own hosts, so the request originates from the tenant's own host, not the control plane. The genuinely live half is the **unbounded download** — a create can point at an arbitrarily large URL and the host fetches it with no cap. **Fix.** Validate the scheme/host, and cap the fetched image size (fail the create past a ceiling rather than filling the host's disk). Authenticated-tenant only; Low–Medium. --- Migrated from git-collab issue `4636c0b9e91e6710f9cbc54fc92354c019bc3ec1`. Original author: a73x <dev@a73x.sh>.