### Summary The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and single-slash scheme variants (`http:/evil.com`) to bypass validation, enabling SSRF and open redirect attacks. ### Affected Package - **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** < e2078417464b - **Patched versions:** >= e2078417464b ### Severity Medium ### CWE CWE-918 — Server-Side Request Forgery (SSRF) ### Details The fix in `NavAction.java` (line 47) introduces a `VALID_LINK` pattern: ```java Pattern.compile("^(https?:/)?/.*") ``` This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors. Protocol-relative URLs (`//evil.com/...`): The group `(https?:/)?` is optional, so the pattern reduces to `//.*` when the group is absent. This matches `//evil.com/steal?c=SESSION`, which browsers resolve to the current page's protocol plus the attacker's host. Single-slash scheme (`http:/evil.com`): The regex group captures `http:/` as a valid match, and browsers normalize `http:/evil.com` to `http://evil.com`, creating an open redirect to the attacker's server. Protocol-relative to cloud metadata (`//169.254.169.254/...`): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved. The pre-fix code had no validation at all, accepting any URL. The fix blocks `javascript:`, `ftp:`, and `data:` URIs, but the protocol-relative and single-slash bypasses remain exploitable. ### PoC ```python """ CVE-2026-35571 - NationalSecurityAgency/emissary SSRF via NavAction The fix in commit e2078417464b adds URL scheme validation using: Pattern.compile("^(https?:/)?/.*") This allows protocol-relative URLs (//evil.com) and single-slash variants (http:/evil.com) to bypass the validation. Tested against: emissary@0d4dc56 (pre-fix) and patch e207841 Extracted from: src/main/java/emissary/server/mvc/NavAction.java:47 """ import re import sys FIXED_PATTERN = re.compile(r"^(https?:/)?/.*") def vulnerable_accepts(link: str) -> bool: """Pre-fix behaviour: no validation, everything passes.""" return True def fixed_accepts(link: str) -> bool: """Post-fix behaviour: must match VALID_LINK pattern.""" return bool(FIXED_PATTERN.match(link)) TEST_VECTORS = [ ("javascript: XSS payload", "javascript:alert(document.cookie)", True), ("ftp: scheme", "ftp://evil.com/exfil", True), ("data: URI", "data:text/html,<script>alert(1)</script>", True), ("Relative path", "/path/to/resource", False), ("HTTP URL", "http://trusted.internal:8080/api", False), ("HTTPS URL", "https://trusted.internal/api", False), ("Protocol-relative URL to attacker host (//evil.com)", "//evil.com/steal?c=SESSION", True), ("Protocol-relative with embedded credentials", "//user:[email protected]/path", True), ("Protocol-relative to cloud metadata (//169.254.169.254)", "//169.254.169.254/latest/meta-data/", True), ("Backslash trick (\\\\evil.com)", "\\\\evil.com/path", True), ("Tab in scheme (java\\tscript:...)", "java\tscript:alert(1)", True), ("Path starting with attacker-like host (/evil.com)", "/evil.com", False), ("Triple slash (///evil.com)", "///evil.com/etc/passwd", True), ("http:/ single-slash to attacker host", "http:/evil.com/steal", True), ("https:/ single-slash to attacker host", "https:/evil.com/steal", True), ("URL-encoded javascript scheme (%6a...)", "%6aavascript:alert(1)", True), ("CRLF injection in path", "/legit\r\nLocation: http://evil.com", True), ] def main(): print("=" * 72) print("CVE-2026-35571 -- Emissary NavAction SSRF / Open-Redirect PoC") print("Pattern under test: ^(https?:/)?/.*") print("=" * 72) print() bypasses_found = [] results_table = [] for desc, url, should_block in TEST_VECTORS: vuln_result = vulnerable_accepts(url) fixed_result = fixed_accepts(url) if should_block and fixed_result: status = "BYPASS" bypasses_found.append((desc, url)) elif should_block and not fixed_result: status = "BLOCKED (good)" elif not should_block and fixed_result: status = "ALLOWED (good)" elif not should_block and not fixed_result: status = "FALSE-POS" else: status = "UNKNOWN" results_table.append((desc, url, vuln_result, fixed_result, status)) for desc, url, vuln, fixed, status in results_table: display_url = repr(url) if len(url) > 50 else url print(f"[{status:>15}] {desc}") print(f"{'':>17} URL: {display_url}") print(f"{'':>17} pre-fix={vuln} post-fix={fixed}") print() print("=" * 72) print(f"Total vectors tested : {len(TEST_VECTORS)}") print(f"Bypasses found : {len(bypasses_found)}") print() if bypasses_found: print("VULNERABILITY CONFIRMED -- the following vectors bypass the fix:") print() for desc, url in bypasses_found: print(f" - {desc}") print(f" URL: {repr(url)}") print() print("Key finding: The regex ^(https?:/)?/.* allows protocol-relative") print("URLs (//evil.com/...) because the optional group (https?:/) can be") print("absent, leaving //.* which matches //attacker.com. This enables") print("SSRF to arbitrary external hosts via navigation links.") print() print("Additionally, http:/evil.com and https:/evil.com match the regex") print("(group 1 captures 'http:/' or 'https:/') and browsers normalise") print("these to http://evil.com, enabling open redirect / SSRF.") sys.exit(0) else: print("No bypasses found -- fix appears complete.") sys.exit(1) if __name__ == "__main__": main() ``` **Steps to reproduce:** 1. Run `python3 poc.py` 2. Observe that protocol-relative and single-slash URLs bypass the regex **Expected output:** ``` VULNERABILITY CONFIRMED Protocol-relative URLs (//evil.com/) and single-slash variants (http:/evil.com) bypass the regex validation. ``` ### Impact An attacker can craft navigation links that bypass URL validation to redirect users to attacker-controlled servers (open redirect) or make the emissary server issue requests to internal services (SSRF). The `//169.254.169.254/latest/meta-data/` bypass is particularly dangerous in cloud environments, enabling retrieval of IAM credentials. ### Suggested Remediation Replace the regex with one that explicitly rejects protocol-relative URLs. Alternatively, parse the URL with `java.net.URI` and validate the scheme and host against an allowlist rather than relying on regex. ### References - Incomplete fix commit: https://github.com/NationalSecurityAgency/emissary/commit/e2078417464b9004620dde28dcbca2f73ea06c13 - Original CVE: CVE-2026-35571