CVE-2024-32980: Spin applications with specific configuration vulnerable to potential network sandbox escape

Some specifically configured Spin applications that use self requests without a specified URL authority can be induced to make requests to arbitrary hosts via the Host HTTP header.

If an application’s manifest contains a component with configuration such as

allowed_outbound_hosts = ["http://self", "https://self"]

and code such as

let res: Response = spin_sdk::http::send(
Request::new(Method::Get, "/") // Note: the request URI does not contain a URL authority
).await?;

Then that application can be induced to send an outgoing request to another host (leading the app to process the response assuming it comes from another component in the same application). This can be induced with a request such as

curl -H"Host: google.com:80" localhost:3000 # Assuming the application is served on localhost:3000

Note: If using a SDK that does not use wasi:http/outgoing-handler, the port can be omitted from the URL.