CVE-2026-59231: Pentestify SSRF Vulnerability

CVE-2026-59231 Overview

CVE-2026-59231 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the PDF export component of maalfer Pentestify before version 1.1.0. Authenticated users can trigger outbound HTTP GET requests from the server to arbitrary destinations. The server-side headless browser fetches unvalidated URLs stored in the finding images field or the report client_logo field during report rendering. Attackers can abuse this to probe internal networks, reach cloud metadata endpoints, or interact with services reachable from the Pentestify backend.

Critical Impact
Authenticated attackers can coerce the Pentestify backend to issue arbitrary outbound HTTP GET requests, enabling internal network reconnaissance and interaction with services not exposed externally.

Affected Products

maalfer Pentestify versions prior to 1.1.0
PDF export component using a server-side headless browser (Playwright)
Pentestify API version 1.0.0

Discovery Timeline

2026-07-31 - CVE-2026-59231 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-59231

Vulnerability Analysis

Pentestify generates PDF pentest reports using a server-side headless browser. When rendering a report, the backend loads image sources referenced in the finding images field and the report client_logo field. Prior to version 1.1.0, these fields accepted any string, including remote HTTP or HTTPS URLs. The rendering engine then fetches those URLs from the server context, allowing an authenticated user to redirect requests toward internal or attacker-controlled destinations.

Because requests originate from the server, they bypass network segmentation controls that block external clients. Common SSRF impact scenarios include enumerating internal hosts, accessing cloud instance metadata services, and interacting with unauthenticated internal APIs. The vulnerability also creates a stored cross-site scripting (XSS) risk when malicious src values break out of the image attribute during rendering.

Root Cause

The root cause is missing input validation on image source fields in the Pydantic schemas used by the Pentestify API. The images and client_logo fields accepted arbitrary URL strings without restricting the scheme or host. The headless browser then dereferenced those URLs during PDF rendering, converting user-supplied input into server-initiated network requests.

Attack Vector

An authenticated user submits or updates a report or finding, placing an attacker-chosen URL such as http://169.254.169.254/latest/meta-data/ or http://internal-service.local/ into the images array or the client_logo field. When the report is exported to PDF, the backend headless browser fetches the URL, and the response (or its side effects) can be inferred from render behavior or leaked into the generated PDF.

python

# Security patch in backend/schemas.py (v1.1.0)
# fix: validate image sources to prevent SSRF and stored XSS
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 from typing import List, Optional
 from datetime import datetime
+import re
+
+
+# Logos y evidencias solo pueden ser data URLs de imagen. Cualquier URL remota
+# se rechaza para evitar SSRF al generar el PDF y XSS al romper el atributo src.
+_DATA_IMAGE_RE = re.compile(r'^data:image/[a-zA-Z0-9.+-]+;base64,[A-Za-z0-9+/=\s]+$')
+
+
+def is_safe_image_src(value) -> bool:
+    return isinstance(value, str) and bool(_DATA_IMAGE_RE.match(value.strip()))
+
+
+def sanitize_image_list(values, keep_slots: bool = False) -> List[str]:
+    cleaned: List[str] = []
+    for v in (values or []):
+        if v == '' or is_safe_image_src(v):
+            cleaned.append(v)
+        elif keep_slots:
+            cleaned.append('')
+    return cleaned

Source: GitHub commit a058a22. The patch enforces that client_logo and finding images values must be data:image/*;base64,... URIs, rejecting any remote URL.

Detection Methods for CVE-2026-59231

Indicators of Compromise

Outbound HTTP GET requests originating from the Pentestify backend to internal IP ranges, link-local addresses such as 169.254.169.254, or unexpected external hosts.
Report or finding records containing client_logo or images values that begin with http:// or https:// rather than data:image/.
Playwright or headless browser process logs referencing unusual remote hostnames during PDF generation.
Pentestify API running version 1.0.0 while report exports are being generated by authenticated low-privilege users.

Detection Strategies

Inspect the Pentestify database for stored images and client_logo values that are not data:image/*;base64, URIs.
Correlate PDF export API calls with egress network flows from the backend host to identify server-initiated requests to unapproved destinations.
Alert on backend HTTP client connections to RFC1918 ranges, 169.254.0.0/16, and cloud metadata endpoints.

Monitoring Recommendations

Log all outbound HTTP requests from the Pentestify backend and headless browser workers, including full URLs and response codes.
Baseline normal report generation traffic and alert on deviations, especially connections to non-approved hosts.
Enable audit logging for authenticated user actions that modify report or finding image fields.

How to Mitigate CVE-2026-59231

Immediate Actions Required

Upgrade Pentestify to version 1.1.0 or later, which enforces data:image/*;base64 validation on client_logo and finding images fields.
Audit existing reports and findings for remote URL values in image fields and remove or convert them to inline data URIs.
Restrict egress network access from the Pentestify backend host to only the destinations required for operation.

Patch Information

The fix is included in the GitHub Release v1.1.1 and originates from commit a058a22b42c6311895622645265df79a60265b1d. The patch introduces is_safe_image_src and sanitize_image_list helpers in backend/schemas.py and bumps the API version from 1.0.0 to 1.1.0. See the CVE-2026-59231 Analysis by Secur0 for the full advisory.

Workarounds

Place the Pentestify backend behind an egress firewall that denies traffic to internal networks, link-local addresses, and cloud metadata IPs.
Run the headless browser worker in a network namespace with no route to sensitive internal services.
Limit report authoring permissions to trusted users until the patched release is deployed.

bash

# Example egress restriction using iptables on the Pentestify backend host
# Block backend process access to link-local metadata and RFC1918 ranges
iptables -A OUTPUT -m owner --uid-owner pentestify -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner pentestify -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner pentestify -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner pentestify -d 192.168.0.0/16 -j REJECT