Mark/osint-hub

Fork 0

HIGH: Browser scraper / Playwright can be used as SSRF proxy to internal services #40

New issue

Closed

opened 2026-05-09 05:19:26 +00:00 by Mark · 4 comments

Mark commented

2026-05-09 05:19:26 +00:00

Owner

Severity: High

Description

The browser_scraper module (backend/app/modules/browser_scraper.py) accepts arbitrary URLs from users and navigates to them using a headless Chromium browser via Playwright. Although validate_url() is called, the SSRF TOCTOU issue applies, and the Playwright browser has full internal network access.

# browser_scraper.py:50
await page.goto(target, wait_until=wait_for, timeout=30000)

After navigation, the module extracts and returns:

Full page text content
All emails (regex extraction)
All phone numbers (regex extraction)
All links (up to 50)
Social media links

Impact

An attacker could:

Read internal service metadata endpoints (e.g., cloud provider metadata)
Access Redis/PostgreSQL admin interfaces if exposed on HTTP
Exfiltrate internal data through returned page content
Use the headless browser for port scanning internal network

Recommendation

Implement strict URL allow-listing or domain allow-listing
Block private IP ranges at the Playwright/network level
Add disclaimer that this is a potentially dangerous module
Consider restricting this module to admin-only in multi-user deployments

## Severity: High ## Description The `browser_scraper` module (backend/app/modules/browser_scraper.py) accepts arbitrary URLs from users and navigates to them using a headless Chromium browser via Playwright. Although validate_url() is called, the SSRF TOCTOU issue applies, and the Playwright browser has full internal network access. ```python # browser_scraper.py:50 await page.goto(target, wait_until=wait_for, timeout=30000) ``` After navigation, the module extracts and returns: - Full page text content - All emails (regex extraction) - All phone numbers (regex extraction) - All links (up to 50) - Social media links ## Impact An attacker could: 1. Read internal service metadata endpoints (e.g., cloud provider metadata) 2. Access Redis/PostgreSQL admin interfaces if exposed on HTTP 3. Exfiltrate internal data through returned page content 4. Use the headless browser for port scanning internal network ## Recommendation 1. Implement strict URL allow-listing or domain allow-listing 2. Block private IP ranges at the Playwright/network level 3. Add disclaimer that this is a potentially dangerous module 4. Consider restricting this module to admin-only in multi-user deployments

Mark added the

blocked:no-changes

label

2026-05-12 02:22:03 +00:00

Mark commented

2026-05-12 02:22:03 +00:00

Author

Owner

GSD IMPLEMENT phase made no changes.
Worker output:

GSD IMPLEMENT phase made no changes. Worker output:

Mark commented

2026-05-12 02:25:00 +00:00

Author

Owner

STATUS: FIXABLE
EVIDENCE: this is a test

STATUS: FIXABLE EVIDENCE: this is a test

Mark commented

2026-05-12 02:29:25 +00:00

Author

Owner

STATUS: FIXABLE
EVIDENCE: SSRF via Playwright goto(target). Mitigations exist: IP range blocking (private/loopback), domain allow-listing, and admin-only gating. Labeled blocked:no-changes suggests design acceptance rather than technical infeasibility.

STATUS: FIXABLE EVIDENCE: SSRF via Playwright goto(target). Mitigations exist: IP range blocking (private/loopback), domain allow-listing, and admin-only gating. Labeled blocked:no-changes suggests design acceptance rather than technical infeasibility.

Mark commented

2026-05-20 19:38:59 +00:00

Author

Owner

Closed by pipeline sweep — no code changes required (blocked:no-changes). Fixer now auto-closes this case going forward.

Mark closed this issue

2026-05-20 19:38:59 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Mark/osint-hub#40

No description provided.

Rows
Columns