Executive brief
Shelf is a platform for tracking physical assets. Authenticated users with import permissions can trick the application into making unauthorized HTTP requests to internal network services, cloud metadata endpoints, or attacker-controlled servers by uploading malicious CSV files with specially crafted image URLs. Attackers can exploit this to access sensitive cloud credentials, enumerate internal infrastructure, or compromise systems within the application's network.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in the Asset CSV Content Import feature. The `isValidImageUrl()` function uses insufficient validation—it only checks for HTTP/HTTPS protocols and image file extensions, but fails to restrict destination hosts, IP ranges, or validate redirect targets. Attackers can bypass validation using multiple techniques: appending image extensions to internal URLs (e.g., `http://169.254.169.254/.../.jpg`), including image-related path keywords in URLs, domain substring matching, and HTTP redirect chains. After validation passes, the application performs an unrestricted `fetch()` request and buffers the entire response body before size validation, creating both SSRF and potential memory exhaustion vectors. Exploitation requires authentication with the `asset:import` permission. A patch is available in version 1.20.3.
Affected products
- Shelf Shelf.nu < 1.20.3
Timeline
- 2026-06-03: disclosed
- 2026-06-03: patched: Version 1.20.3