From 3b37afec7b127029fe01e70f55e921f9a1a8badf Mon Sep 17 00:00:00 2001 From: James Blair Date: Tue, 21 Nov 2023 10:25:20 +1300 Subject: [PATCH] Don't follow redirects when checking peer urls. It's possible that etcd server may run into SSRF situation when adding a new member. If users provide a malicious peer URL, the existing etcd members may be redirected to other unexpected internal URL when getting the new member's version. Signed-off-by: James Blair --- server/etcdserver/cluster_util.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/etcdserver/cluster_util.go b/server/etcdserver/cluster_util.go index 85e66a0ad..069d1af8c 100644 --- a/server/etcdserver/cluster_util.go +++ b/server/etcdserver/cluster_util.go @@ -240,6 +240,9 @@ func getVersion(lg *zap.Logger, m *membership.Member, rt http.RoundTripper, time cc := &http.Client{ Transport: rt, Timeout: timeout, + CheckRedirect: func(req *http.Request, via []*http.Request) error { + return http.ErrUseLastResponse + }, } var ( err error