CVE-2026-54442

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

Summary

The URL validation regex ^(https?:/)?/.* added to emissary's NavAction.java allows protocol-relative URLs (//evil.com/...) and single-slash scheme variants (http:/evil.com) to bypass validation, enabling SSRF and open redirect attacks.

Affected Package

• Ecosystem: Maven
• Package: NationalSecurityAgency/emissary
• Affected versions: < e2078417464b
• Patched versions: >= e2078417464b

Severity

Medium

CWE

CWE-918 — Server-Side Request Forgery (SSRF)

Details

The fix in NavAction.java (line 47) introduces a VALID_LINK pattern:

Pattern.compile("^(https?:/)?/.*")

This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors.

Protocol-relative URLs (//evil.com/...): The group (https?:/)? is optional, so the pattern reduces to //.* when the group is absent. This matches //evil.com/steal?c=SESSION, which browsers resolve to the current page's protocol plus the attacker's host.

Single-slash scheme (http:/evil.com): The regex group captures http:/ as a valid match, and browsers normalize http:/evil.com to http://evil.com, creating an open redirect to the attacker's server.

Protocol-relative to cloud metadata (//169.254.169.254/...): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved.

The pre-fix code had no validation at all, accepting any URL. The fix blocks javascript:, ftp:, and data: URIs, but the protocol-relative and single-slash bypasses remain exploitable.

PoC

"""
CVE-2026-35571 - NationalSecurityAgency/emissary SSRF via NavAction

The fix in commit e2078417464b adds URL scheme validation using:
    Pattern.compile("^(https?:/)?/.*")

This allows protocol-relative URLs (//evil.com) and single-slash variants
(http:/evil.com) to bypass the validation.

Tested against: emissary@0d4dc56 (pre-fix) and patch e207841
Extracted from: src/main/java/emissary/server/mvc/NavAction.java:47
"""

import re
import sys

FIXED_PATTERN = re.compile(r"^(https?:/)?/.*")


def vulnerable_accepts(link: str) -> bool:
    """Pre-fix behaviour: no validation, everything passes."""
    return True


def fixed_accepts(link: str) -> bool:
    """Post-fix behaviour: must match VALID_LINK pattern."""
    return bool(FIXED_PATTERN.match(link))


TEST_VECTORS = [
    ("javascript: XSS payload",
     "javascript:alert(document.cookie)", True),
    ("ftp: scheme",
     "ftp://evil.com/exfil", True),
    ("data: URI",
     "data:text/html,<script>alert(1)</script>", True),

    ("Relative path",
     "/path/to/resource", False),
    ("HTTP URL",
     "http://trusted.internal:8080/api", False),
    ("HTTPS URL",
     "https://trusted.internal/api", False),

    ("Protocol-relative URL to attacker host (//evil.com)",
     "//evil.com/steal?c=SESSION", True),
    ("Protocol-relative with embedded credentials",
     "//user:[email protected]/path", True),
    ("Protocol-relative to cloud metadata (//169.254.169.254)",
     "//169.254.169.254/latest/meta-data/", True),
    ("Backslash trick (\\\\evil.com)",
     "\\\\evil.com/path", True),
    ("Tab in scheme (java\\tscript:...)",
     "java\tscript:alert(1)", True),
    ("Path starting with attacker-like host (/evil.com)",
     "/evil.com", False),
    ("Triple slash (///evil.com)",
     "///evil.com/etc/passwd", True),
    ("http:/ single-slash to attacker host",
     "http:/evil.com/steal", True),
    ("https:/ single-slash to attacker host",
     "https:/evil.com/steal", True),
    ("URL-encoded javascript scheme (%6a...)",
     "%6aavascript:alert(1)", True),
    ("CRLF injection in path",
     "/legit\r\nLocation: http://evil.com", True),
]


def main():
    print("=" * 72)
    print("CVE-2026-35571 -- Emissary NavAction SSRF / Open-Redirect PoC")
    print("Pattern under test: ^(https?:/)?/.*")
    print("=" * 72)
    print()

…

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.

Summary

The URL validation regex ^(https?:/)?/.* added to emissary's NavAction.java allows protocol-relative URLs (//evil.com/...) and single-slash scheme variants (http:/evil.com) to bypass validation, enabling SSRF and open redirect attacks.

Affected Package

• Ecosystem: Maven
• Package: NationalSecurityAgency/emissary
• Affected versions: < e2078417464b
• Patched versions: >= e2078417464b

Severity

Medium

CWE

CWE-918 — Server-Side Request Forgery (SSRF)

Details

The fix in NavAction.java (line 47) introduces a VALID_LINK pattern:

Pattern.compile("^(https?:/)?/.*")

This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors.

Protocol-relative URLs (//evil.com/...): The group (https?:/)? is optional, so the pattern reduces to //.* when the group is absent. This matches //evil.com/steal?c=SESSION, which browsers resolve to the current page's protocol plus the attacker's host.

Single-slash scheme (http:/evil.com): The regex group captures http:/ as a valid match, and browsers normalize http:/evil.com to http://evil.com, creating an open redirect to the attacker's server.

Protocol-relative to cloud metadata (//169.254.169.254/...): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved.

The pre-fix code had no validation at all, accepting any URL. The fix blocks javascript:, ftp:, and data: URIs, but the protocol-relative and single-slash bypasses remain exploitable.

PoC

"""
CVE-2026-35571 - NationalSecurityAgency/emissary SSRF via NavAction

The fix in commit e2078417464b adds URL scheme validation using:
    Pattern.compile("^(https?:/)?/.*")

This allows protocol-relative URLs (//evil.com) and single-slash variants
(http:/evil.com) to bypass the validation.

Tested against: emissary@0d4dc56 (pre-fix) and patch e207841
Extracted from: src/main/java/emissary/server/mvc/NavAction.java:47
"""

import re
import sys

FIXED_PATTERN = re.compile(r"^(https?:/)?/.*")


def vulnerable_accepts(link: str) -> bool:
    """Pre-fix behaviour: no validation, everything passes."""
    return True


def fixed_accepts(link: str) -> bool:
    """Post-fix behaviour: must match VALID_LINK pattern."""
    return bool(FIXED_PATTERN.match(link))


TEST_VECTORS = [
    ("javascript: XSS payload",
     "javascript:alert(document.cookie)", True),
    ("ftp: scheme",
     "ftp://evil.com/exfil", True),
    ("data: URI",
     "data:text/html,<script>alert(1)</script>", True),

    ("Relative path",
     "/path/to/resource", False),
    ("HTTP URL",
     "http://trusted.internal:8080/api", False),
    ("HTTPS URL",
     "https://trusted.internal/api", False),

    ("Protocol-relative URL to attacker host (//evil.com)",
     "//evil.com/steal?c=SESSION", True),
    ("Protocol-relative with embedded credentials",
     "//user:[email protected]/path", True),
    ("Protocol-relative to cloud metadata (//169.254.169.254)",
     "//169.254.169.254/latest/meta-data/", True),
    ("Backslash trick (\\\\evil.com)",
     "\\\\evil.com/path", True),
    ("Tab in scheme (java\\tscript:...)",
     "java\tscript:alert(1)", True),
    ("Path starting with attacker-like host (/evil.com)",
     "/evil.com", False),
    ("Triple slash (///evil.com)",
     "///evil.com/etc/passwd", True),
    ("http:/ single-slash to attacker host",
     "http:/evil.com/steal", True),
    ("https:/ single-slash to attacker host",
     "https:/evil.com/steal", True),
    ("URL-encoded javascript scheme (%6a...)",
     "%6aavascript:alert(1)", True),
    ("CRLF injection in path",
     "/legit\r\nLocation: http://evil.com", True),
]


def main():
    print("=" * 72)
    print("CVE-2026-35571 -- Emissary NavAction SSRF / Open-Redirect PoC")
    print("Pattern under test: ^(https?:/)?/.*")
    print("=" * 72)
    print()

…