CVE-2026-73474 in Entity Share Websub
Summary
by MITRE • 09/02/2026
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The identified vulnerability represents a critical security flaw within the Entity Share Websub module for Drupal, specifically affecting version ranges from 0.0.0 through 1.1.2. This issue is classified as a Server-Side Request Forgery (SSRF) attack vector, which poses significant risks to both the immediate application environment and potentially broader internal network infrastructure. SSRF vulnerabilities occur when an application retrieves data from a remote server using user-supplied input without proper validation or sanitization of the destination address. In this specific context, the Websub module facilitates content syndication via the WebSub protocol, which relies on HTTP requests to notify subscribers about updates. The flaw lies in how these outgoing notifications are constructed and executed by the backend system.
From a technical perspective, the vulnerability stems from insufficient validation mechanisms applied to the callback URLs or topic endpoints provided during the subscription process. When an administrator or authorized user configures a subscriber endpoint within the Entity Share Websub module, the application accepts this input and subsequently initiates HTTP requests on behalf of the server to that specified address. Because the system does not adequately restrict the protocol schemes, IP addresses, or domain names allowed in these URLs, an attacker can manipulate the input to point towards internal services, local host interfaces, or other sensitive resources within the organization's network perimeter. This allows the Drupal application to act as a proxy for arbitrary requests, effectively bypassing firewall rules that are typically designed to prevent external clients from accessing internal assets directly.
The operational impact of this vulnerability is severe and multifaceted. An attacker with access to the vulnerable module interface can exploit this flaw to perform network reconnaissance by probing internal services such as database servers, management consoles, or cloud metadata endpoints like AWS EC2 instance metadata service version 1 (IMDSv1). By analyzing the HTTP responses returned from these internal requests, an attacker can determine which services are running and their configurations. Furthermore, if sensitive data is transmitted in plaintext over internal networks, it may be intercepted through this SSRF channel. In more advanced scenarios, this vulnerability could serve as a pivot point for lateral movement within the network, allowing attackers to reach systems that are not directly exposed to the internet but are trusted by the web server. This aligns with common attack patterns observed in real-world intrusions where internal services are leveraged to escalate privileges or exfiltrate data.
This vulnerability is categorized under CWE-918, which defines Server-Side Request Forgery as a weakness enabling an attacker to cause the server-side application to make requests to arbitrary URLs. Additionally, it maps to MITRE ATT&CK technique T1571, specifically Subversion of Trustworthy Channels or Entities, where attackers exploit trusted relationships between systems to gain unauthorized access. The exploitation typically falls under Initial Access or Discovery phases depending on whether the goal is immediate compromise or information gathering.
Mitigation strategies must focus on strict input validation and network-level controls. Administrators should immediately upgrade Entity Share Websub to a version later than 1.1.2, where this issue has been addressed by implementing robust URL parsing and restriction logic. If upgrading is not immediately feasible, temporary mitigations include restricting outbound HTTP traffic from the web server using host-based firewalls or network segmentation policies. These controls should whitelist only known external domains required for legitimate syndication activities while blocking access to private IP ranges such as 10.x.x.x, 172.16.x.x through 172.31.x.x, and 192.168.x.x. Additionally, implementing a proxy server that inspects outbound requests can provide an additional layer of defense by validating destination addresses against a safe list before allowing the request to proceed. Regular security audits and code reviews focusing on external resource interactions are essential to prevent similar SSRF vulnerabilities in future development cycles.