CVE-2026-54442

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

Published

2026-10-30

Modified

2026-11-04

Aliases

GHSA-c6q7-wqw2-h65w

Sources

github-advisory

Summary

### Summary The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and single-slash scheme variants (`http:/evil.com`) to bypass validation, enabling SSRF and open redirect attacks. ### Affected Package - **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** = e2078417464b ### Severity Medium ### CWE CWE-918 — Server-Side Request Forgery (SSRF) ### Details The fix in `NavAction.java` (line 47) introduces a `VALID_LINK` pattern: ```java Pattern.compile("^(https?:/)?/.*") ``` This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors. Protocol-relative URLs (`//evil.com/...`): The group `(https?:/)?` is optional, so the pattern reduces to `//.*` when the group is absent. This matches `//evil.com/steal?c=SESSION`, which browsers resolve to the current page's protocol plus the attacker's host. Single-slash scheme (`http:/evil.com`): The regex group captures `http:/` as a valid match, and browsers normalize `http:/evil.com` to `http://evil.com`, creating an open redirect to the attacker's server. Protocol-relative to cloud metadata (`//169.254.169.254/...`): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved. The pre-fix code had no validation at all, accepting any URL. The fix blocks `javascript:`, `ftp:`, and `data:` URIs, but the protocol-relative and single-slash bypasses remain exploitable. ### PoC ```python """ CVE-2026-35571 - NationalSecurityAgency/emissary SSRF via NavAction The fix in commit e2078417464b adds URL scheme validation using: Pattern.compile("^(https?:/)?/.*") This allows protocol-relative URLs (//evil.com) and single-slash variants (http:/evil.com) to bypass the validation. Tested against: emissary@0d4dc56 (pre-fix) and patch e207841 Extracted from: src/main/java/emissary/server/mvc/NavAction.java:47 """ import re import sys FIXED_PATTERN = re.compile(r"^(https?:/)?/.*") def vulnerable_accepts(link: str) -> bool: """Pre-fix behaviour: no validation, everything passes.""" return True def fixed_accepts(link: str) -> bool: """Post-fix behaviour: must match VALID_LINK pattern.""" return bool(FIXED_PATTERN.match(link)) TEST_VECTORS = [ ("javascript: XSS payload", "javascript:alert(document.cookie)", True), ("ftp: scheme", "ftp://evil.com/exfil", True), ("data: URI", "data:text/html, alert(1) ", True), ("Relative path", "/path/to/resource", False), ("HTTP URL", "http://trusted.internal:8080/api", False), ("HTTPS URL", "https://trusted.internal/api", False), ("Protocol-relative URL to attacker host (//evil.com)", "//evil.com/steal?c=SESSION", True), ("Protocol-relative with embedded credentials", "//user:[email protected]/path", True), ("Protocol-relative to cloud metadata (//169.254.169.254)", "//169.254.169.254/latest/meta-data/", True), ("Backslash trick (\\\\evil.com)", "\\\\evil.com/path", True), ("Tab in scheme (java\\tscript:...)", "java\tscript:alert(1)", True), ("Path starting with attacker-like host (/evil.com)", "/evil.com", False), ("Triple slash (///evil.com)", "///evil.com/etc/passwd", True), ("http:/ single-slash to attacker host", "http:/evil.com/steal", True), ("https:/ single-slash to attacker host", "https:/evil.com/steal", True), ("URL-encoded javascript scheme (%6a...)", "%6aavascript:alert(1)", True), ("CRLF injection in path", "/legit\r\nLocation: http://evil.com", True), ] def main(): print("=" * 72) print("CVE-2026-35571 -- Emissary NavAction SSRF / Open-Redirect PoC") print("Pattern under test: ^(https?:/)?/.*") print("=" * 72) print()

Affected packages

Remediation: Upgrade to 8.51.0 or later.

References

• https://github.com/advisories/GHSA-c6q7-wqw2-h65w