file:///etc/passwd.A collaboration tool allows users to paste links into messages. The API generates a preview: POST /api/preview { "url": "https://news.example.com/article/123" }. The server fetches the URL, extracts the title, description, and image, and returns them.
The API uses a URL-fetching library that supports http://, https://, and file:// protocols. The developer only intended HTTPS links — but never restricted which protocols are allowed.
POST /api/preview { "url": "file:///etc/passwd" }. The server’s URL-fetching library reads the local file /etc/passwd and returns its contents as the “preview” response. The attacker now has the server’s user list. They follow up with: file:///etc/environment (environment variables), file:///app/.env (application secrets), file:///home/ubuntu/.ssh/id_rsa (SSH private key). Each returns the file contents as a “preview.”The correct fix is a protocol allowlist: only permit https:// URLs (and http:// if specifically required). Block file://, dict://, gopher://, ftp://, and any other protocol the feature doesn’t need. This is one line in most URL-fetching library configurations — but it has to be explicitly set.