The css_parser Ruby library versions from 2.2.0 up to but not including 3.0.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the CssParser::Parser#read_remote_file method. This method, used by load_uri! and the @import-following branch of add_block!, issues HTTP and HTTPS requests without restrictions on host, port, or URI scheme. It lacks allowlists or filtering for link-local, loopback, or RFC-1918 addresses. Redirects are followed recursively, and file:// URIs are also processed, enabling an attacker to escalate SSRF to arbitrary local file disclosure via a crafted redirect. The vulnerability affects any application that passes attacker-influenced CSS with a base_uri option to css_parser. The issue is resolved in version 3.0.0.

An attacker can exploit this vulnerability to make the vulnerable application perform HTTP/HTTPS requests to arbitrary hosts, including internal network resources, potentially accessing sensitive internal services. Furthermore, due to recursive redirect handling and file URI processing, the attacker can escalate the attack to disclose arbitrary local files on the server. This can lead to information disclosure and potentially further compromise depending on the environment.

Upgrade css_parser to version 3.0.0 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 3.0.0.