SillyTavern SSRF via Inadequate Hostname Validation
Overview
SillyTavern, a local UI for interacting with various AI models, suffers from a Server-Side Request Forgery (SSRF) vulnerability prior to version 1.17.0. The vulnerability resides in `src/endpoints/search.js` where the validation for hostnames is overly restrictive. It strictly checks for dotted-quad IPv4 addresses (e.g., 127.0.0.1) using the regex `/^\d+\.\d+\.\d+\.\d+$/`. This validation fails to account for other loopback mechanisms like the hostname `localhost`, IPv6 loopback address `[::1]`, and crucially, arbitrary DNS names that can be configured to resolve to internal IP addresses (e.g., `localtest.me` pointing to `127.0.0.1`). This allows an attacker to potentially craft requests that bypass the intended network restrictions, enabling them to probe or interact with internal services accessible from the SillyTavern host. The severity is somewhat mitigated by an additional check ensuring the `urlObj.port` is not empty, which effectively limits exploitation to services running on non-default ports, thus avoiding immediate exploitation on common web ports like 80 or 443.
Affected Systems
Testing Guide
1. Ensure you are running a version of SillyTavern prior to 1.17.0. 2. Configure a local DNS server or use a public DNS service (if applicable and permissible) to map a custom domain (e.g., `evil.local`) to an internal IP address (e.g., `127.0.0.1` or a known internal service IP). 3. Attempt to craft a request within SillyTavern that uses this custom domain as the target hostname, potentially including a non-default port. 4. Monitor network traffic originating from the SillyTavern host to observe if it attempts to connect to the specified internal address. 5. Test with `localhost` and `[::1]` as hostnames to confirm if these are also processed incorrectly.
Mitigation Steps
* Update SillyTavern to version 1.17.0 or later. * Implement stricter network controls on the host running SillyTavern to limit outbound connections. * Review and sanitize any user-provided input that is used to construct network requests within SillyTavern. * Consider using a network proxy or firewall to monitor and block suspicious outbound traffic from the SillyTavern instance.
Patch Details
Version 1.17.0