GHSA-6x26-6r6f-m537

Описание

Summary

The ALLOWED_SOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list (the overwhelming majority of real-world and documented configurations) are passed directly to re.match() without escaping. Because . is a regex wildcard, every dot in a domain name becomes a bypass vector: s.glbimg.com silently matches sXglbimgYcom, sAglbimg.com, and any other hostname that differs only at a dot position. This undermines the primary SSRF defence that ALLOWED_SOURCES is intended to provide.

Affected component

thumbor/loaders/http_loader.py — validate()

Proof of concept

Root cause

thumbor/loaders/http_loader.py (before fix):

Impact

An attacker who can influence the image source URL passed to Thumbor can fetch images from arbitrary hosts, bypassing the ALLOWED_SOURCES allowlist.

Preconditions:

• ALLOWED_SOURCES contains at least one plain-string entry (the common case; all official documentation examples use plain strings).
• The attacker can supply or influence the image URL — true whenever ALLOW_UNSAFE_URL = True (the default), or when the application forwards user input to a signed URL endpoint.

Fix

Apply re.escape() to plain-string patterns before compiling them, so every character is matched literally:

This is a one-call addition with no breaking change for correctly written configurations. Users who need real regular-expression behaviour should supply a compiled pattern (re.compile(r"s\.glbimg\.com")), which is already handled by the existing isinstance(pattern, Pattern) branch and is unaffected by this change.

The ALLOWED_SOURCES docstring in config.py was also updated to document the two-mode behaviour explicitly.