Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader
Summary
Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection.
Vulnerable Code
1. Webhook Send Endpoint (Most Critical)
apps/backend/src/api/routes/webhooks.controller.ts lines 58-70:
```typescript
async sendWebhook(@Body() body: any, @Query('url') url: string) {
try {
await fetch(url, { // No URL validation
method: 'POST',
body: JSON.stringify(body),
headers: { 'Content-Type': 'application/json' },
});
} catch (err) { }
return { send: true };
}
```
Accepts arbitrary URL via query parameter and fetches directly.
2. Stored Webhook Delivery
apps/orchestrator/src/activities/post.activity.ts lines 256-281:
```typescript
async sendWebhooks(postId: string, orgId: string, integrationId: string) {
const webhooks = await this._webhookService.getWebhooks(orgId);
return Promise.all(
webhooks.map(async (webhook) => {
await fetch(webhook.url, { // Stored URL, no validation
method: 'POST',
body: JSON.stringify(post),
});
})
);
}
```
3. RSS/XML Feed Parser
libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts line 135:
```typescript
async loadXML(url: string) {
const { items } = await parser.parseURL(url); // No URL validation
}
```
4. HTML Content Loader
libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts line 185:
```typescript
async loadUrl(url: string) {
const loadDom = new JSDOM(await (await fetch(url)).text()); // No validation
}
```
Missing Protections
- No
request-filtering-agent or SSRF library - No private IP range filtering
- No cloud metadata endpoint blocking
- No DNS rebinding protection
- URL validation only via
@IsUrl() decorator (format only, no IP check)
Attack Scenarios
1. POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/ → AWS metadata theft
2. POST /autopost/send?url=http://127.0.0.1:6379 → Internal Redis access
3. Create webhook with http://10.0.0.1:8080/admin → Internal service access on post publish
Impact
- Cloud metadata theft: AWS/GCP/Azure credentials
- Internal network scanning: Full access to private IP ranges
- Multiple entry points: Webhooks, RSS feeds, URL loader all vulnerable
