SSRF via improper validation after DNS name resolution in the link-preview feature

This is a different report from the one I submitted before: #3383079

Summary

In Rocket.Chat version 7.11.0, the link-preview is a feature that displays a preview of a linked page when a link is sent in the chat, and it is enabled by default. On the server side, the hostname of the posted URL is initially checked to see if it is a local IP address. Then if it's a local one, link-preview doesn't work. However, there is no validation of the IP address after DNS resolution. Therefore, By obtaining some domain and pointing it to a local IP address, an attacker can trigger SSRF and access internal hosts that would otherwise be unreachable.

Details

In my test environment, I set up an httpbin server on the same LAN as the Rocket.Chat server to verify whether SSRF was possible. The httpbin server is running at 192.168.100.14:80, and the attacker cannot reach this server directly.