Block SSRF in SAML metadata URL fetching
fix: block SSRF in SAML metadata URL fetching
Block SSRF in SAML metadata URL fetching70a562-fix-block-ssrf-in-saml-metadata-url-cve-2026-42858fixblock ssrf saml metadata url fetching
Committed by feanil
commit message
fix: block SSRF in SAML metadata URL fetching
Adds `validate_saml_metadata_url()` to third_party_auth utils, which
enforces HTTPS and blocks loopback, link-local (including cloud metadata
endpoints like 169.254.169.254), and reserved IP addresses. RFC 1918
private ranges are blocked by default and can be opted out via
`SAML_METADATA_URL_ALLOW_PRIVATE_IPS = True` for deployments where the
SAML IdP lives on the same private network.
Calls the validator in `fetch_saml_metadata()` before `requests.get()`,
also adds a 30s request timeout and removes the previous non-enforcing
HTTP warning.
Addresses the platform-side fetch path described in:
https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9
Note: the primary exploit path (`sync_provider_data` endpoint) now lives
in edx-enterprise following the migration documented in
docs/decisions/0025-saml-admin-views-in-enterprise-plugin.rst and will
need a corresponding fix there.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>Editor assessment
This commit patches CVE-2026-42858. The subject is direct, `fix: block SSRF in SAML metadata URL fetching`, and the body repays reading. It names the new validator, the HTTPS requirement and the blocked ranges - loopback, link-local including the 169.254.169.254 metadata endpoint, and reserved space - then explains the deliberate RFC 1918 default with an opt-out flag for legitimate on-premise identity providers, a real trade-off rather than boilerplate. It documents where the validator runs, the added 30-second timeout and the removal of the old non-enforcing warning. The advisory link plus the note that the primary exploit path moved to edx-enterprise is exactly the context a reader needs.