GHSA-r2x7-427f-rq69: Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

April 10, 2026

The validateWebhookURL function in webhook_setting_service.go attempts to block webhooks targeting private/internal IP addresses, but only checks literal IP strings via net.ParseIP(). Hostnames that DNS-resolve to private IPs (e.g., 169.254.169.254.nip.io, 10.0.0.1.nip.io) bypass all checks, allowing an admin to create webhooks that make server-side requests to internal network services and cloud metadata endpoints.

References

github.com/advisories/GHSA-r2x7-427f-rq69
github.com/lin-snow/Ech0
github.com/lin-snow/Ech0/releases/tag/v4.4.3
github.com/lin-snow/Ech0/security/advisories/GHSA-r2x7-427f-rq69

Code Behaviors & Features

Detect and mitigate GHSA-r2x7-427f-rq69 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →