OSV 1.4.0 · github-reviewed · 修改于 2026-06-09 22:28
发布时间
2026-02-18 08:56
GitHub 审查时间
2026-02-18 08:56
NVD 发布时间
2026-02-20 08:16
源文件
advisories/github-reviewed/2026/02/GHSA-wgm6-9rvv-3438/GHSA-wgm6-9rvv-3438.json
该公告已于 2026-06-09 22:28 撤回
内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。
Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it.
Anyone holding this permission already has full administrative control over the application, and outbound HTTP to operator-chosen URLs is the documented purpose of the webhook feature. This is working as designed.
A SECURITY.md documenting the threat model will be added to the repo shortly.
Date: 2025-12-07 Vulnerability: Server-Side Request Forgery (SSRF) Severity: Medium Component: Webhooks Module
A critical security vulnerability exists in the LibreDesk Webhooks module that allows an authenticated "Application Admin" to compromise the underlying cloud infrastructure or internal corporate network where this service is being hosted.
The application fails to validate destination URLs for webhooks. This allows an attacker to force the server to make HTTP requests to arbitrary internal destinations.
Attackers can map the internal network by observing the difference between successful connections and connection errors. This works even if the response body is not returned.
Proof of Exploitation (from Server Logs):
timestamp=... level=info message="webhook delivered successfully" ... status_code=200
timestamp=... level=error message="webhook delivery failed" ... error="... connect: connection refused"
Impact: An attacker can identify running services (databases, caches, internal apps) on the local network (e.g., localhost, 192.168.x.x).
If the internal service returns a non-2xx response (e.g., 403 Forbidden, 404 Not Found, 500 Error), the application .
Proof of Exploitation (from Server Logs):
timestamp=... level=error message="webhook delivery failed" ...
response="{\"secret_key\": \"xxx123\", \"role\": \"admin\"}"
Impact: An attacker can extract sensitive data by targeting endpoints that return errors or by forcing errors on internal services.
cmd/webhooks.go only checks if the URL is empty, not if it resolves to a private IP.internal/webhook/webhook.go uses a default http.Client that follows redirects and connects to any IP.To prevent this, the application must implement Defense in Depth:
http.Transport that verifies the destination IP address after DNS resolution to prevent DNS rebinding attacks.