GHSA-q78c-5jjq-57g8 - A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery) - **Affected versions:** `<= 1.2.0.Final` (and `1.2.1.Final-SNAPSHOT` on `main` prior to the fix) - **Patched version:** _(the release that carries the fix)_ - **CWE:** CWE-918 (Server-Side Request Forgery) - **Severity:** High - **CVSS v3.1:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N` (5.8, Moderate) --- ## Summary An **unauthenticated** attacker can coerce the a2a-java server into issuing HTTP requests to arbitrary internal and cloud-metadata endpoints from the server's own network position — a Server-Side Request Forgery reachable in the default deployment with no credentials, no user interaction, and a single request. The behaviour is the shipped default, not a misconfiguration. ## Details `BasePushNotificationSender` (in `server-common`) POSTs task data to the URL stored on a task's `TaskPushNotificationConfig` with no validation of the destination: no block on loopback, RFC1918, link-local (`169.254.0.0/16`, including the `169.254.169.254` metadata address), unique-local, unspecified, or multicast ranges; no scheme restriction; and no bound on redirects. `InMemoryPushNotificationConfigStore.setInfo` stores the URL verbatim and `onCreateTaskPushNotificationConfig` does not check it either. Both shipped HTTP clients follow redirects (`JdkA2AHttpClient` → `followRedirects(NORMAL)`, `VertxA2AHttpClient` → `setFollowRedirects(true)`), so a creation-time URL allowlist is bypassable: an attacker webhook answers `302 Location: http://169.254.169.254/...` and the client follows it. A hostname check is likewise defeated by DNS rebinding. A correct guard must validate the *resolved* IP of every hop at connection time, not the URL string. ## Exploitation Demonstrated end-to-end against a running server (default wiring, unauthenticated caller): - **Arbitrary internal reachability.** The attacker picks the destination and the server