SSRF Vulnerability in Nango via Configuration Interpolation

Nango versions up to and including 0.70.4 contain a Server-Side Request Forgery (SSRF) vulnerability. The issue arises from the application's failure to properly validate caller-supplied connection configuration values before interpolating them into provider token and proxy URL templates. By submitting maliciously crafted configuration inputs, an authenticated attacker can manipulate these templates to force the Nango server to initiate outbound requests to arbitrary destinations. This is particularly critical for cloud-hosted instances, where attackers can direct requests toward internal infrastructure or cloud instance metadata services (e.g., IMDS) to exfiltrate sensitive provider credentials or internal configuration tokens stored within the environment.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized requests on behalf of the Nango server. In cloud environments, this may lead to the compromise of provider credentials, access to internal APIs, or the exfiltration of sensitive metadata. The scope of impact is limited to the network reachability of the Nango instance itself.

Recommendation

Prioritize patching the Nango instance to a version greater than 0.70.4 once an update is available. As a temporary mitigation, audit and restrict the ability of authenticated users to modify connection configurations and implement egress network filtering (e.g., via security groups or firewalls) to prevent the Nango server from reaching cloud metadata endpoints or unauthorized internal IP ranges.