| शीर्षक | Woahai321 list-sync <=0.6.6 SSRF |
|---|
| विवरण | The POST /api/notifications/test endpoint accepts a user-supplied webhook_url in the request body and passes it directly to requests.post() (or DiscordWebhook) without any URL validation or allowlist check. An attacker sends a crafted JSON payload with webhook_url pointing to an attacker-controlled server. The application issues an outbound HTTP request to that URL, confirmed by DNS callback hits from the server's IP. This SSRF can be used for internal network scanning, cloud metadata exfiltration (e.g. AWS IMDSv1), or port probing.
|
|---|
| स्रोत | ⚠️ https://github.com/Woahai321/list-sync/issues/79 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 26/02/2026 09:05 AM (7 महीनों पहले) |
|---|
| संयम | 11/03/2026 01:36 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 350388 [Woahai321 ListSync तक 0.6.6 JSON api_server.py requests.post अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|