-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/charmbracelet/soft-serve | go | < 0.11.0 | 0.11.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in the webhook functionality of Soft Serve. The root cause is the lack of URL validation when creating or updating webhooks. Repository administrators could specify webhook URLs pointing to internal network addresses, cloud metadata endpoints, or other sensitive locations.
The analysis of the patch commit bb73b9a0eea0d902da4811420535842a4f9aae3b confirms this. The changes introduce validation logic to prevent this.
pkg/backend/webhooks.go: The functions CreateWebhook and UpdateWebhook were modified to include a call to the new webhook.ValidateWebhookURL function. Before this change, these functions accepted any URL provided by the user and persisted it, making them the entry point for the vulnerability.
pkg/webhook/webhook.go: The do function, which is responsible for dispatching the webhook, was changed to use a new secureHTTPClient. This client has a custom dialer that explicitly blocks connections to private and reserved IP addresses. The original code used http.DefaultClient, which has no such restrictions, and was the function that actually executed the forged request.
Therefore, the vulnerable functions are backend.CreateWebhook and backend.UpdateWebhook for accepting the malicious input, and webhook.do for executing the outbound request to the malicious URL.
A Semantic Attack on Google Gemini - Read the Latest Research