AI 安全
OpenMAIC 1.0.2 Fixes DNS Rebinding and Cloud Metadata SSRF, Blocks Classroom Overwrites
OpenMAIC’s media proxy previously resolved DNS again after validating a domain, allowing an external hostname to point to an internal network at connection time; another path permitted access to an Alibaba Cloud metadata address. Version 1.0.2 now connects using a pinned resolution result and generates classroom IDs server-side, but the changes may affect deployments that access local models over CGNAT ranges used by Tailscale and similar services.
The open-source multi-agent teaching platform OpenMAIC released version 1.0.2 on September 14, fixing three issues that could be triggered through network requests. The two most critical flaws were both located in `/api/proxy-media` and the shared outbound URL protections. First, an incorrect denylist application order allowed the Alibaba Cloud instance metadata address `100.100.100.200` to pass through as an IP literal. Second, a classic DNS rebinding flaw occurred because the application initially resolved and validated a hostname, but resolved it again when actually calling `fetch()`. An attacker could change the DNS response from a public IP address to an internal address between the two lookups. According to the [official changelog](https://github.com/THU-MAIC/OpenMAIC/blob/main/CHANGELOG.md), the new release checks metadata, mapped, and encoded address representations first, then uses a shared pinned dispatcher to connect only to the address that the protections actually validated. The same rules are applied to every hop in a redirect chain.
The third vulnerability affected `POST /api/classroom`. Callers could previously specify a classroom ID, potentially overwriting existing classroom content when a temporary file was renamed. Version 1.0.2 now generates IDs server-side and creates files exclusively, returning HTTP 409 after a limited number of retries if collisions persist. This is more than a conventional web vulnerability: OpenMAIC calls model, search, and media services on users’ behalf, and self-hosted instances typically hold provider keys. If SSRF reaches a cloud metadata service, an attacker may be able to obtain workload credentials.
The upgrade also introduces compatibility changes. Client-supplied `stage.id` values are now ignored. The `100.64.0.0/10` CGNAT range is blocked by default, so deployments that connect to local models or media hosts over overlay networks such as Tailscale may need to explicitly set `ALLOW_LOCAL_NETWORKS=true`. Some IANA-reserved, documentation, broadcast, and multicast ranges are rejected unconditionally. After upgrading, operators should retest internal model endpoints, redirect chains, and API clients, and verify that enabling local-network access does not reopen the proxy’s SSRF attack surface.