GHSA-89v5-38xr-9m4j Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader

Summary

Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection.

Vulnerable Code

1. Webhook Send Endpoint (Most Critical)

apps/backend/src/api/routes/webhooks.controller.ts lines 58-70:

async sendWebhook(@Body() body: any, @Query('url') url: string) {
  try {
    await fetch(url, {  // No URL validation
      method: 'POST',
      body: JSON.stringify(body),
      headers: { 'Content-Type': 'application/json' },
    });
  } catch (err) { }
  return { send: true };
}

Accepts arbitrary URL via query parameter and fetches directly.

2. Stored Webhook Delivery

apps/orchestrator/src/activities/post.activity.ts lines 256-281:

async sendWebhooks(postId: string, orgId: string, integrationId: string) {
  const webhooks = await this._webhookService.getWebhooks(orgId);
  return Promise.all(
    webhooks.map(async (webhook) => {
      await fetch(webhook.url, {  // Stored URL, no validation
        method: 'POST',
        body: JSON.stringify(post),
      });
    })
  );
}

3. RSS/XML Feed Parser

libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts line 135:

async loadXML(url: string) {
  const { items } = await parser.parseURL(url);  // No URL validation
}

4. HTML Content Loader

libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts line 185:

async loadUrl(url: string) {
  const loadDom = new JSDOM(await (await fetch(url)).text());  // No validation
}

Missing Protections

• No request-filtering-agent or SSRF library
• No private IP range filtering
• No cloud metadata endpoint blocking
• No DNS rebinding protection
• URL validation only via @IsUrl() decorator (format only, no IP check)

Attack Scenarios

1. POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/ → AWS metadata theft
2. POST /autopost/send?url=http://127.0.0.1:6379 → Internal Redis access
3. Create webhook with http://10.0.0.1:8080/admin → Internal service access on post publish

Impact

• Cloud metadata theft: AWS/GCP/Azure credentials
• Internal network scanning: Full access to private IP ranges
• Multiple entry points: Webhooks, RSS feeds, URL loader all vulnerable