Summary
Multiple management API endpoints accept an attacker-controlled absolute URL (e.g. url, base_url on webhooks and third party integrations such as Dynatrace / Datadog / New Relic) and persist it with no allow list, scheme restriction, DNS resolution check, or internal network deny list at the application layer. When a feature flag state later changes, the task processor issues an outbound request to that stored URL from inside the deployment's network. This is a server-side request forgery (SSRF) vector.
Combined with open self registration (ALLOW_REGISTRATION_WITHOUT_INVITE=True, which mints an active session), the chain can be driven end to end by an unauthenticated external actor.
Steps to reproduce
POST /api/v1/auth/users/ to create an account (open registration mints an active session).- Create an organisation, project and environment.
- Register a webhook or a Dynatrace / Datadog / New Relic integration whose URL points at an internal or attacker controlled host.
- Toggle a feature flag to trigger the server-side request.
Summary
Multiple management API endpoints accept an attacker-controlled absolute URL (e.g.
url,base_urlon webhooks and third party integrations such as Dynatrace / Datadog / New Relic) and persist it with no allow list, scheme restriction, DNS resolution check, or internal network deny list at the application layer. When a feature flag state later changes, the task processor issues an outbound request to that stored URL from inside the deployment's network. This is a server-side request forgery (SSRF) vector.Combined with open self registration (
ALLOW_REGISTRATION_WITHOUT_INVITE=True, which mints an active session), the chain can be driven end to end by an unauthenticated external actor.Steps to reproduce
POST /api/v1/auth/users/to create an account (open registration mints an active session).