DNS Rebinding Attack

How it was found

Hi, there is a DNS rebinding vulnerability in your SSRF filter.

{F4891755}

You validate the hostname's IP address, but then pass the hostname to Net::HTTP.start(), which does its own DNS lookup. An attacker can control a DNS server that returns a safe public IP during validation, then returns 127.0.0.1 when Net::HTTP resolves it shortly later...

::Net::HTTP.start(uri.hostname, uri.port, **http_options) do |http| # Currently using uri.hostname which triggers a new dns lookup!

Example POC: Attacker sets up evil.com DNS to alternate responses. First query (your validation) returns 8.8.8.8. Second query (Net::HTTP's internal lookup) returns 127.0.0.1. As a result: SsrfFilter.get('http://evil.com:6379') bypasses all protection and hits some internal service on localhost..

Suggested fix: Connect directly to the validated IP instead of the hostname. Change Net::HTTP.start(uri.hostname, ...) to Net::HTTP.start(validated_ip, ...) and set the Host header manually: headers['Host'] = uri.hostname. Also use ssl_hostname: uri.hostname for proper TLS certificate validation. This eliminates the race window entirely since DNS only resolves once during validation.

Impact

The library validates DNS resolution but passes the hostname (not the validated IP) to Net::HTTP, which performs a second DNS lookup. Attacker's DNS server returns different IPs for each query