CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to exploit the webhook functionality by supplying arbitrary URLs without proper validation, potentially leading to the server sending crafted requests to internal endpoints, including sensitive link-local addresses. This could result in unauthorized access to internal resources or data leakage, as the requests are processed without validating their legitimacy. Organizations using the affected API should prioritize this issue to mitigate the risk of internal exploitation and ensure the integrity of their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.