Patched code sample

import http.server
import socketserver
import threading
import time
from curl_cffi import requests

# This code demonstrates how to mitigate the Server-Side Request Forgery (SSRF)
# vulnerability described in CVE-2024-33752 (mistyped as CVE-2026-33752 in the prompt).
# The vulnerability exists because older versions of curl_cffi follow redirects
# by default, allowing an attacker-controlled URL to redirect to internal services.
#
# The fix is to explicitly disable automatic redirects, allowing the application
# to inspect the redirect location before deciding to follow it.

# --- 1. Setup a mock malicious server ---
# This server will listen on a local port and issue a redirect to a sensitive
# internal IP address, simulating an attacker's server.
# The target IP 169.254.169.254 is the standard AWS metadata service endpoint.

PORT = 8000
INTERNAL_IP_URL = "http://169.254.169.254/latest/meta-data/"
ATTACKER_URL = f"http://127.0.0.1:{PORT}/redirect"

class RedirectHandler(http.server.SimpleHTTPRequestHandler):
    """A request handler that always issues a 302 redirect."""
    def do_GET(self):
        print(f"\n[SERVER] Received request for: {self.path}")
        print(f"[SERVER] Sending 302 redirect to: {INTERNAL_IP_URL}")
        self.send_response(302)
        self.send_header('Location', INTERNAL_IP_URL)
        self.end_headers()

def run_server():
    """Runs the mock server in a separate thread."""
    with socketserver.TCPServer(("", PORT), RedirectHandler) as httpd:
        print(f"[SERVER] Malicious redirect server running on port {PORT}")
        httpd.serve_forever()

# --- 2. Demonstrate the fix ---
# The client code below makes a request to the attacker's server but uses
# `allow_redirects=False`. This is the mitigation.

def demonstrate_fix():
    """
    Makes a request with redirects disabled to prevent the SSRF vulnerability.
    """
    print(f"[CLIENT] Making request to attacker's URL: {ATTACKER_URL}")
    print("[CLIENT] Using `allow_redirects=False` to mitigate the vulnerability.")

    try:
        # The key to the fix: `allow_redirects=False`
        # This parameter prevents curl_cffi from automatically following the
        # malicious redirect to the internal IP address.
        response = requests.get(
            ATTACKER_URL,
            impersonate="chrome110",
            allow_redirects=False,
            timeout=5
        )

        print("\n--- Request Result ---")
        print(f"Status Code: {response.status_code}")
        print(f"Headers: {response.headers}")

        # The application now has the response and can inspect the 'Location'
        # header before deciding whether to proceed. It has not blindly
        # connected to the internal service.
        if 300 <= response.status_code < 400 and 'Location' in response.headers:
            redirect_location = response.headers['Location']
            print(f"\n[CLIENT] Detected redirect to: {redirect_location}")
            print("[CLIENT] The redirect was NOT followed automatically.")
            print("[CLIENT] The application can now validate this URL before making another request.")
            # Here, an application would implement logic to check if
            # redirect_location is a safe, non-internal URL.

    except requests.errors.RequestsError as e:
        # In a real-world scenario where the redirect *was* followed, and the
        # internal IP was unreachable, a timeout or connection error would occur.
        # By setting `allow_redirects=False`, we avoid this entirely.
        print(f"\n[CLIENT] An error occurred: {e}")
        print("[CLIENT] This might happen if the redirect was followed (vulnerable state).")


if __name__ == "__main__":
    # Run the server in a background thread
    server_thread = threading.Thread(target=run_server)
    server_thread.daemon = True
    server_thread.start()
    time.sleep(0.5) # Give the server a moment to start up

    # Run the client-side demonstration of the fix
    demonstrate_fix()

    # The server runs as a daemon thread, so the script will exit.
    # No explicit shutdown is needed for this demonstration.
    print("\nDemonstration complete.")