Add IP address denylist for JWKS URL validation (SSRF hardening)

[cuioss-oliver]

Problem

The JwksValidationServlet.validateJwksUrl() method can reach internal networks even with authentication enforced. An authenticated NiFi user could use the JWKS URL validation endpoint to probe internal infrastructure.

Threat

• Probe RFC 1918 private networks (10.x, 172.16-31.x, 192.168.x)
• Access cloud metadata endpoints (169.254.169.254)
• Reach localhost services (127.0.0.1, ::1)

Current Mitigations (already implemented)

• ApiKeyAuthenticationFilter requires X-Processor-Id header (restricts to authenticated NiFi UI users)
• cui-http URL path validation pipeline detects suspicious URL patterns
• HttpHandler with connection/read timeouts

Proposed Additional Mitigation

Add IP address validation before HTTP connection:

InetAddress[] addresses = InetAddress.getAllByName(uri.getHost());
for (InetAddress addr : addresses) {
    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||
        addr.isSiteLocalAddress() || addr.isAnyLocalAddress() ||
        addr.isMulticastAddress()) {
        return JwksValidationResult.failure("JWKS URL resolves to restricted IP address");
    }
}

Notes

• cui-http does NOT have built-in IP address validation — this is a custom check
• This should be applied after URL scheme validation but before the HTTP fetch
• Consider DNS rebinding: validate after resolution, not just the hostname
• Consider IPv6-mapped IPv4 addresses (e.g., ::ffff:127.0.0.1)

Labels

security, enhancement