Shlink 5.0.1 can fetch an authenticated user's longUrl from the server side during automatic short URL title resolution. When AUTO_RESOLVE_TITLES is enabled and no explicit title is supplied, a valid API key can trigger requests to internal destinations.
Short URL create and edit flows pass the submitted longUrl into the short URL title-resolution helper when automatic title resolution is enabled. The helper issues a server-side GET request through the configured HTTP client and extracts the page title from the response.
The create/edit request controls longUrl, and the reachability condition is AUTO_RESOLVE_TITLES being enabled with no explicit title in the request. The long URL validation accepts URL-shaped values and does not enforce an internal-address block before the title fetch.
The returned page title can be stored or returned with the short URL. This makes the issue both an outbound request primitive and a limited response-content disclosure primitive through the extracted title.
- Enable
AUTO_RESOLVE_TITLESin Shlink 5.0.1 and use any valid API key. - Start a server-reachable listener that returns HTML containing
<title>internal-ok</title>. - Send an authenticated short URL creation request without a
title, usinglongUrlset to the listener URL such ashttp://127.0.0.1:8080/. - Observe the listener receiving a GET request from the Shlink server.
- Observe the created short URL storing or returning the resolved title value
internal-ok.
The observed result is authenticated SSRF through automatic title resolution. Where the feature is enabled, a user with an API key can cause Shlink to connect to internal HTTP services and can receive selected response content through the resolved page title.