NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

Summary

The URL validation regex ^(https?:/)?/.* added to emissary's NavAction.java allows protocol-relative URLs (//evil.com/...) and single-slash scheme variants (http:/evil.com) to bypass validation, enabling SSRF and open redirect attacks.

Affected Package

• Ecosystem: Maven
• Package: NationalSecurityAgency/emissary
• Affected versions: < e2078417464b
• Patched versions: >= e2078417464b

Severity

Medium

CWE

CWE-918 — Server-Side Request Forgery (SSRF)

Details

The fix in NavAction.java (line 47) introduces a VALID_LINK pattern:

Pattern.compile("^(https?:/)?/.*")

This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors.

Protocol-relative URLs (//evil.com/...): The group (https?:/)? is optional, so the pattern reduces to //.* when the group is absent. This matches //evil.com/steal?c=SESSION, which browsers resolve to the current page's protocol plus the attacker's host.

Single-slash scheme (http:/evil.com): The regex group captures http:/ as a valid match, and browsers normalize http:/evil.com to http://evil.com, creating an open redirect to the attacker's server.

Protocol-relative to cloud metadata (//169.254.169.254/...): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved.

The pre-fix code had no validation at all, accepting any URL. The fix blocks javascript:, ftp:, and data: URIs, but the protocol-relative and single-slash bypasses remain exploitable.

PoC

"""
CVE-2026-35571 - NationalSecurityAgency/emissary SSRF via NavAction

The fix in commit e2078417464b adds URL scheme validation using:
    Pattern.compile("^(https?:/)?/.*")

This allows protocol-relative URLs (//evil.com) and single-slash variants
(http:/evil.com) to bypass the validation.

Tested against: emissary@0d4dc56 (pre-fix) and patch e207841
Extracted from: src/main/java/emissary/server/mvc/NavAction.java:47
"""

import re
import sys

FIXED_PATTERN = re.compile(r"^(https?:/)?/.*")


def vulnerable_accepts(link: str) -> bool:
    """Pre-fix behaviour: no validation, everything passes."""
    return True


def fixed_accepts(link: str) -> bool:
    """Post-fix behaviour: must match VALID_LINK pattern."""
    return bool(FIXED_PATTERN.match(link))


TEST_VECTORS = [
    ("javascript: XSS payload",
     "javascript:alert(document.cookie)", True),
    ("ftp: scheme",
     "ftp://evil.com/exfil", True),
    ("data: URI",
     "data:text/html,<script>alert(1)</script>", True),

    ("Relative path",
     "/path/to/resource", False),
    ("HTTP URL",
     "http://trusted.internal:8080/api", False),
    ("HTTPS URL",
     "https://trusted.internal/api", ),

    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
    (,
     , ),
]


 ():
    ( * )
    ()
    ()
    ( * )
    ()

    bypasses_found = []
    results_table = []

     desc, url, should_block  TEST_VECTORS:
        vuln_result = vulnerable_accepts(url)
        fixed_result = fixed_accepts(url)

         should_block  fixed_result:
            status = 
            bypasses_found.append((desc, url))
         should_block   fixed_result:
            status = 
          should_block  fixed_result:
            status = 
          should_block   fixed_result:
            status = 
        :
            status = 

        results_table.append((desc, url, vuln_result, fixed_result, status))

     desc, url, vuln, fixed, status  results_table:
        display_url = (url)  (url) >   url
        ()
        ()
        ()
        ()

    ( * )
    ()
    ()
    ()

     bypasses_found:
        ()
        ()
         desc, url  bypasses_found:
            ()
            ()
        ()
        ()
        ()
        ()
        ()
        ()
        ()
        ()
        ()
        sys.exit()
    :
        ()
        sys.exit()


 __name__ == :
    main()

Steps to reproduce:

1. Run python3 poc.py
2. Observe that protocol-relative and single-slash URLs bypass the regex

Expected output:

VULNERABILITY CONFIRMED
Protocol-relative URLs (//evil.com/) and single-slash variants (http:/evil.com) bypass the regex validation.

Impact

An attacker can craft navigation links that bypass URL validation to redirect users to attacker-controlled servers (open redirect) or make the emissary server issue requests to internal services (SSRF). The //169.254.169.254/latest/meta-data/ bypass is particularly dangerous in cloud environments, enabling retrieval of IAM credentials.

Suggested Remediation

Replace the regex with one that explicitly rejects protocol-relative URLs. Alternatively, parse the URL with java.net.URI and validate the scheme and host against an allowlist rather than relying on regex.

References

• Incomplete fix commit: https://github.com/NationalSecurityAgency/emissary/commit/e2078417464b9004620dde28dcbca2f73ea06c13
• Original CVE: CVE-2026-35571