9router: Image prefetch DNS rebinding allows SSRF to internal services

Summary

9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the server-side image prefetch to reach internal-only HTTP services (SSRF).

Details

• Affected version / commit: 9router v0.4.80 @ b282f05.
• Reachable through /v1/chat/completions with a vision-capable model and an image_url content part. A vision-capable model name is required so the image survives modality stripping and the server-side prefetch is armed.
• The provider used in this reproduction is the bundled mock provider — no real API key and no real provider call.
• internal-admin (the SSRF target) is not exposed to the host network; it is reachable only from inside the Docker network.
• rebind-dns behaviour for rebind.9r.test:
  • first A response → 1.1.1.1 (public) to pass the public-host guard,
  • second A response → 172.29.0.10 (internal-admin) during the fetch.
• internal-admin logs GET /ssrf-marker with peer=172.29.0.30 (the proxied-router container), proving the server-side fetch landed on the internal service.
• mock-provider receives POST /api/chat and the flow completes with HTTP 200.
• Root cause: DNS TOCTOU — the IP is not pinned between the validation resolution (the public-host guard) and the fetch resolution. The guard and the fetch each resolve the hostname independently, so a TTL-0 rebinding authority can return a public IP to the guard and an internal IP to the fetch.

Proof of Concept

This repository is a self-contained Docker Compose reproduction. No real provider is called and no real API key is required.

1. Build and start the stack:

   docker compose up --build
   

2. Confirm internal-admin is unreachable from the host:

   curl -i http://127.0.0.1:18083/ssrf-marker   # connection refused / fail
   docker compose ps                            # internal-admin has NO host port mapping