HTTP delivery targets can hit localhost, cloud metadata endpoints (169.254.169.254), and internal network IPs. This is a server-side request forgery (SSRF) vulnerability.
Suggested fix: Validate and block private/reserved IP ranges (RFC 1918, link-local, loopback) in delivery target URLs. Resolve DNS before connecting and check the resolved IP.
## From Security Audit ([#33 comment](https://git.eeqj.de/sneak/webhooker/issues/33#issuecomment-10915))
**Severity: BLOCKER**
HTTP delivery targets can hit localhost, cloud metadata endpoints (169.254.169.254), and internal network IPs. This is a server-side request forgery (SSRF) vulnerability.
**Suggested fix:** Validate and block private/reserved IP ranges (RFC 1918, link-local, loopback) in delivery target URLs. Resolve DNS before connecting and check the resolved IP.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From Security Audit (#33 comment)
Severity: BLOCKER
HTTP delivery targets can hit localhost, cloud metadata endpoints (169.254.169.254), and internal network IPs. This is a server-side request forgery (SSRF) vulnerability.
Suggested fix: Validate and block private/reserved IP ranges (RFC 1918, link-local, loopback) in delivery target URLs. Resolve DNS before connecting and check the resolved IP.
clawbot referenced this issue2026-08-20 06:20:36 +02:00