5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-r2x7-427f-rq69

GHSA-r2x7-427f-rq69: Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Summary

The validateWebhookURL function in webhook_setting_service.go attempts to block webhooks targeting private/internal IP addresses, but only checks literal IP strings via net.ParseIP(). Hostnames that DNS-resolve to private IPs (e.g., 169.254.169.254.nip.io, 10.0.0.1.nip.io) bypass all checks, allowing an admin to create webhooks that make server-side requests to internal network services and cloud metadata endpoints.

Details

The vulnerability is in validateWebhookURL (internal/service/setting/webhook_setting_service.go:180-199):

func validateWebhookURL(rawURL string) error {
    parsed, err := url.Parse(rawURL)
    // ...
    host := strings.ToLower(parsed.Hostname())
    if host == "" || host == "localhost" || strings.HasSuffix(host, ".local") {
        return errors.New(commonModel.INVALID_WEBHOOK_URL)
    }
    if ip := net.ParseIP(host); ip != nil {  // <-- returns nil for hostnames
        if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalMulticast() ||
            ip.IsLinkLocalUnicast() || ip.IsUnspecified() {
            return errors.New(commonModel.INVALID_WEBHOOK_URL)
        }
    }
    return nil  // hostname passes all checks unchecked
}

net.ParseIP("169.254.169.254.nip.io") returns nil because it is not a literal IP address. The entire private IP check block is skipped, and the function returns nil (valid).

Both HTTP clients that execute webhook requests use standard http.Client / http.Transport with no custom DialContext to verify resolved IPs:

TestWebhook (webhook_setting_service.go:169): &http.Client{Timeout: 5 * time.Second}
Dispatcher (dispatcher.go:51-58): &http.Client{...Transport: &http.Transport{...}} — no custom dialer

The Dispatcher.HandleObservation () iterates all active webhooks and dispatches without re-validating URLs, so a stored malicious webhook triggers SSRF on every application event.

Miggo Vulnerability Database

→

GHSA-r2x7-427f-rq69

GHSA-r2x7-427f-rq69:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/lin-snow/ech0	go	< 4.4.3	4.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the webhook functionality, originating from improper URL validation. The root cause is in the service.validateWebhookURL function, which failed to check the resolved IP address of hostnames, only checking literal IPs. This allowed an administrator to create a webhook with a URL (e.g., http://10.0.0.1.nip.io) that resolves to a private or otherwise restricted IP address.

The exploitation of this vulnerability occurs when the application makes an HTTP request to the malicious webhook URL. This happens in two primary functions:

service.SettingService.TestWebhook: Allows an admin to manually trigger a test of the webhook, causing an immediate SSRF.
webhook.Dispatcher.HandleObservation: This function is part of the event-driven architecture and automatically sends requests to all active webhooks. This creates a persistent SSRF, as any stored malicious webhook will be triggered repeatedly.

Both of these execution paths used a standard http.Client that would blindly resolve the hostname and connect to the resulting IP. The patch remediates the vulnerability by replacing the standard http.Client with a NewSafeHTTPClient. This new client employs a custom DialContext (httpUtil.SecureDialContext) which performs DNS resolution and then explicitly checks if the resolved IP address is in a blocked range (private, loopback, etc.) before establishing a connection, effectively preventing the SSRF.

Vulnerable functions

service.validateWebhookURL

internal/service/setting/webhook_setting_service.go

This function is responsible for validating webhook URLs. The vulnerability lies in its use of `net.ParseIP` on the hostname. This function returns nil for hostnames that are not literal IP addresses, causing the validation logic for private, loopback, and other restricted IP ranges to be skipped entirely. This allows an attacker to use a DNS service (like nip.io) to create a hostname that resolves to a restricted IP, bypassing the check and enabling SSRF.

service.SettingService.TestWebhook

internal/service/setting/webhook_setting_service.go

This function is used to send a test request to a configured webhook. Before the patch, it used a standard `http.Client` which does not validate the resolved IP address of a hostname. When an attacker provides a malicious webhook URL that has passed the flawed `validateWebhookURL` check, calling this function triggers a server-side request to the internal service targeted by the URL.

webhook.Dispatcher.HandleObservation

internal/webhook/dispatcher.go

This function is the entry point for the event dispatcher, which sends notifications to all active webhooks. The dispatcher was initialized with a standard `http.Client` that was vulnerable to SSRF because it would resolve and connect to any IP address returned by a DNS query for the webhook's hostname. An attacker could create a persistent SSRF by setting an active webhook with a malicious URL, which would then be triggered by this function upon any new application event. The patch replaces the vulnerable client in the `NewDispatcher` constructor with a safe client that validates resolved IPs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-r2x7-427f-rq69: Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Summary

Details

GHSA-r2x7-427f-rq69:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

5.5

5.5

GHSA-r2x7-427f-rq69: Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Summary

Details

PoC

Impact

Recommended Fix

5.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-r2x7-427f-rq69: Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Summary

Details

GHSA-r2x7-427f-rq69:

5.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

5.5

5.5

GHSA-r2x7-427f-rq69: Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

Summary

Details

PoC

Impact

Recommended Fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI