Merge pull request #228 from AikidoSec/stored-ssrf-fix-valid-imds-case

If the hostname is an IP, skip the stored ssrf vulnerability

Author: bitterpanda63

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/ssrf/imds/Resolver.java

@@ -14,6 +14,11 @@ public static String resolvesToImdsIp(Set<String> resolvedIpAddresses, String ho
             return null;
         }
         for (String ip : resolvedIpAddresses) {
+            if (hostname.trim().equals(ip.trim())) {
+                // If the hostname is the IP, that means no resolving is happening
+                // so the request is safe.
+                continue;
+            }
             if (IMDSAddresses.isImdsIpAddress(ip)) {
                 return ip;
             }

agent_api/src/test/java/vulnerabilities/ssrf/ResolverTest.java

@@ -27,6 +27,14 @@ void testResolvesToImdsIp_WithImdsIp() {
         assertEquals("169.254.169.254", Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
     }
 
+    @Test
+    void testDoesntResolveToImdsIp_WithHostnameImdsIp() {
+        Set<String> resolvedIps = new HashSet<>();
+        resolvedIps.add("169.254.169.254"); // IMDS IP
+
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, " 169.254.169.254 "));
+    }
+
     @Test
     void testResolvesToImdsIp_WithMultipleResolvedIps_OneImdsIp() {
         Set<String> resolvedIps = new HashSet<>();

agent_api/src/test/java/vulnerabilities/ssrf/StoredSSRFDetectorTest.java

@@ -70,6 +70,13 @@ void run_WhenIpIsIpv6ImdsIp_ReturnsAttack() {
         assertNull(result.user);
     }
 
+    @Test
+    void run_WhenIpIsIpv6ImdsIp_ReturnsAttackNotWhenIpIsHostname() {
+        Attack result = detector.run("fd00:ec2::254", List.of("fd00:ec2::254"), "testOperation");
+        assertNull(result);
+    }
+
+
     @Test
     void run_WhenIpIsNotImdsIp_ReturnsNull() {
         Attack result = detector.run("test.example.com", List.of("192.168.1.1"), "testOperation");