GHSA-5p3m-vhh6-9236: stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
Stigmem allows an authenticated user to create a webhook subscription with a user-controlled delivery_address. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request.
The codebase already contains an outbound SSRF guard, assert_safe_url(), which blocks loopback, private, link-local, and metadata-style destinations. However, the subscription webhook delivery path does not appear to apply this guard either when the subscription is created or immediately before delivery.
As a result, an authenticated user can configure a webhook destination such as http://127.0.0.1:9999/ssrf, trigger a matching fact-change event, and cause the Stigmem server to issue a server-side HTTP request to an internal loopback address.
References
- github.com/advisories/GHSA-5p3m-vhh6-9236
- github.com/eidetic-labs/stigmem/commit/11637401d50629fef040382aee5af4571842c152
- github.com/eidetic-labs/stigmem/commit/2ff5be29291d1c042e00d57c5f9ef93650cc90e0
- github.com/eidetic-labs/stigmem/pull/726
- github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a11
- github.com/eidetic-labs/stigmem/security/advisories/GHSA-5p3m-vhh6-9236
Code Behaviors & Features
Detect and mitigate GHSA-5p3m-vhh6-9236 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →