Wallos Server-Side Request Forgery Vulnerability in Webhook Test Endpoint

A server-side request forgery (SSRF) vulnerability has been identified in Wallos, a personal subscription tracker, in versions prior to 4.6.2. The issue resides in the 'testwebhooknotifications.php' file, which fails to validate target URLs against private or reserved IP ranges. This oversight allows authenticated users to send requests to internal services, potentially leaking sensitive information. The vulnerability has been patched in version 4.6.2.

Impact

Exploitation of this vulnerability allows authenticated users to read responses from internal services, including cloud instance metadata, which could contain sensitive credentials.

Reproduction

To reproduce this vulnerability, log into the application and obtain a CSRF token. Then, send a POST request to the 'testwebhooknotifications.php' endpoint, including the target URL as a parameter. The server response will reveal that the internal service was accessed, demonstrating the successful exploitation of the SSRF vulnerability.

Remediation

Users can update to Wallos version 4.6.2 or later, where this vulnerability has been fixed.