SSRF vulnerability in KubeVela VelaUX APIServer

Vulnerability

Overview

CVE-2022-39383 is a blind Server-Side Request Forgery (SSRF) vulnerability affecting the KubeVela application delivery platform, specifically the VelaUX APIServer component. The root cause lies in the Helm chart delivery functionality: when a user deploys an application using a Helm chart, the APIServer does not validate or restrict the URL of the Helm repository. This allows an attacker to supply a malicious repository address that triggers a request from the server to an arbitrary internal or external host [1][3].

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must have access to the VelaUX APIServer, typically through the platform's web interface or API. The attacker then creates or modifies an application component that specifies a Helm chart from a controlled repository URL. When the server processes this component, it makes an HTTP request to the supplied address. Because the request is blind (i.e., the attacker cannot directly see the response), the attacker must infer internal network information through side-channel techniques such as timing differences or error messages [2][4].

Impact

A successful blind SSRF attack enables an attacker to probe internal services, cloud metadata endpoints, or other networked resources that the KubeVela server can reach. While the vulnerability does not directly allow reading of response data, it can be used to map internal networks, detect running services, and potentially interact with unauthenticated internal APIs. This increases the risk of further compromise within the cluster or adjacent infrastructure [1][4].

Mitigation

The KubeVela project has released patched versions to address this issue: users on v1.6 should upgrade to v1.6.1, and users on v1.5 should upgrade to v1.5.8. The fix, implemented in pull request #5000, forbids following HTTP redirects (302 responses) during Helm chart retrieval, mitigating the SSRF vector [3]. There are no known workarounds [1].