Draft security report — not filed

For Paul to send, through whichever channel he judges right. I have not filed this anywhere. github.com/carlosframework/rastrillo is a public repo and this is an unauthenticated server-side request forgery affecting every app built on it, so where and how it gets disclosed is a decision for the person who owns the org, not for an agent at 3am.

Found 2026-09-05 while building memoria's sign-in dial guard (gate 33). memoria's §3.2 has recorded the shallow version of this since its code review — "an anonymous visitor can make the instance dial any domain they type" — and Fable's review of QUESTIONS #6 said the fetcher's hardening should be checked before assuming it was only an existence leak. It was checked. It is not only an existence leak.

---

The class

Unauthenticated SSRF with an attacker-chosen destination, reachable from the sign-in form of any rastrillo app, before any admission check.

Where

github.com/keymaildev/signin, classify.go — the Classifier, called from rastrillo/auth's Begin handler (auth/handlers.go, the a.flow.Begin(...) call) which runs before auth.Config.Authorize.

Mechanism

1. POST /auth/begin with any address. No session, no admission check.
2. Classifier.delegate resolves TXT for _keymail.<domain>.
3. A record of the form v=… host=… returns host verbatim. There is no allowlist, no scheme check, no port restriction and no private-address-range check on that value.
4. getJSON then issues a GET to a URL built from it, using &http.Client{Timeout: 5s} — default redirect policy, so up to ten redirects are followed to wherever they point.
5. On NXDOMAIN, delegate returns the bare domain, so the fetch happens for essentially any syntactically valid domain, not only delegated ones.

Anyone who controls DNS for any domain therefore chooses the destination. The instance makes the request from its own network position.

Why it matters more than the existence leak

The recorded consequence was: instance existence, egress IP, timing channel. The actual reach is whatever the instance's network can reach — link-local metadata endpoints, private ranges, and internal services that answer GET — with redirects followed and a 1 MiB body read. No content returns to the attacker directly, which bounds it, but response timing and status are observable through the sign-in flow's own behaviour.

Suggested fix, and the pattern already exists in this codebase

amadan.net/oficina/suite's transport.go solves the same problem for sibling calls and is the shape to copy:

• the host is checked before the transport dials, so a refused host costs no connection;
• redirects are refused outright rather than bounded — "an allowed host has to be reached to tell us to redirect";
• the check is exported separately from the client, because more than the HTTP path needs it.

For signin specifically: refuse private, loopback, link-local and unspecified ranges after resolution (not before — resolve, then check the IP, or the check is bypassable by DNS); pin the scheme to https and the port to 443; refuse redirects. And in rastrillo/auth, run Config.Authorize before flow.Begin, which removes the anonymous reachability independently of the fetcher's own hardening.

What memoria has done, and what it does not fix

memoria's beginGuard (this branch, 0bd3023) runs the admission predicate before the classifier, so an unadmitted address triggers no DNS query and no fetch. Gate 33 holds it, mutation-tested five ways.

It does not fix this. It narrows memoria's exposure to owners, and it does nothing for any other rastrillo app. An owner can still reach the unhardened fetcher. The fix belongs upstream.

Disclosure note

Written to describe the defect and its fix. It deliberately contains no ready-to-run reproduction. Whether it goes to a public issue, a private advisory, or straight to a patch is Paul's call — a public issue on a public repo publishes the reachability to everyone running a rastrillo app before any of them can deploy a fix, which argues for the patch first.