Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.
The SSRF (Server-Side Request Forgery) vulnerability occurs when three conditions are met simultaneously: the deployment environment routes traffic to Spin based on the request URL (not the `Host` header), leaving the original `Host` header value unchanged; the Spin application component handling the incoming request has an `allow_outbound_hosts` list configured containing the value "self"; and in response to the incoming request, the component makes an outgoing request without an explicitly specified hostname or port in the URL. In this case, Spin uses the value of the `Host` header to construct the outgoing request, allowing an attacker to specify any host by manipulating this header.
An attacker can cause a Spin application to send HTTP requests to arbitrary, unauthorized hosts, which may result in unauthorized access to internal network resources, sensitive data disclosure, or data modification through interaction with unintended services.
Spin should be updated to version 2.4.3 or later, where the issue has been fixed. The patch is available in the project repository (commit b3db535c9edb72278d4db3a201f0ed214e561354). Additionally, it is recommended to verify the `allow_outbound_hosts` configuration in application components and ensure that outgoing requests always have an explicitly specified hostname and port in the URL.
The Spin tool in versions prior to 2.4.3, although the vulnerability is only exposed in specifically configured applications that meet the described environmental and configuration conditions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N