| tiêu đề | Casdoor v2.356.0 Server-Side Request Forgery |
|---|
| Mô tả | Webhook SSRF (Server-Side Request Forgery)
**Evidence:**
```go
req, err := http.NewRequest(webhook.Method, webhook.Url, body)
// ...
resp, err := client.Do(req) // No URL validation, no internal network blocking
```
Admin-configured webhook URLs are fetched without any restriction on target address. No SSRF protections are in place.
**Attack scenario:** An attacker who gains org-admin access configures a webhook URL pointing to `http://x.x.x.x/latest/meta-data/` (AWS metadata endpoint) or internal services, exfiltrating cloud credentials or scanning internal infrastructure.
**Fix:** Validate webhook URLs against a denylist of private/reserved IP ranges. Use a dedicated HTTP client that resolves DNS and blocks connections to internal addresses.
--- |
|---|
| Người dùng | Ghufran Khan (UID 95493) |
|---|
| Đệ trình | 17/03/2026 14:25 (cách đây 6 các tháng) |
|---|
| Kiểm duyệt | 03/04/2026 09:26 (17 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 355073 [Casdoor 2.356.0 Webhook URL nâng cao đặc quyền] |
|---|
| điểm | 17 |
|---|