SSRF in Webhooks Severity: High (7.7 / 10) Package Repository: github.com/charmbracelet/soft-serve (Go) Affected Versions: < v0.11.0 Patched Versions: v0.11.1 Description SUMMARY We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. AFFECTED COMPONENTS (VERIFIED) 1. Webhook Creation (pkg/ssh/cmd/webhooks.go:125) 2. Backend CreateWebhook (pkg/backend/webhooks.go:17) 3. Backend UpdateWebhook (pkg/backend/webhooks.go:122) 4. Webhook Delivery (pkg/webhook/webhook.go:97) IMPACT This vulnerability allows repository administrators to perform SSRF attacks, potentially enabling: Cloud Metadata Theft - Access AWS/Azure/GCP credentials via 169.254.169.254 Internal Network Access - Target localhost and private networks (10.x, 192.168.x, 172.16.x) Port Scanning - Enumerate internal services via response codes and timing Data Exfiltration - Full HTTP responses stored in webhook delivery logs Internal API Access - Call internal admin panels and Kubernetes endpoints PROOF OF CONCEPT Simple example demonstrating localhost access: Then push to trigger. CVSS v3 Base Metrics Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None CVE ID CVE-2025-64522 Weaknesses CWE-918 Credits Reporter: Tomer-PL Remediation Developer: caarlos0