Description
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
simstudioai sim
Default version status: unaffected
0 to < 0.8.14affected
pkg:github/simstudioai/simReferences
- https://github.com/geo-chen/oss/blob/main/sim.md ↗
- https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/tools/index.ts ↗
- https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/lib/auth/hybrid.ts ↗
- https://github.com/simstudioai/sim/pull/7179 ↗
- https://github.com/simstudioai/sim ↗
- https://www.vulncheck.com/advisories/sim-before-0.8.14-confused-deputy-in-tool-url-routing-mints-an-internal-token-for-a-user-supplied-api-path ↗