Plunk Server-Side Request Forgery Vulnerability in AWS SNS Webhook Handler

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Plunk, an open-source email platform that utilizes AWS Simple Email Service (SES). This vulnerability exists in versions of Plunk prior to 0.7.0, within the SNS webhook handler. An unauthenticated attacker could exploit this issue by sending a crafted request that prompts the server to make an arbitrary outbound HTTP GET request to any host accessible from the server.

Impact

Exploitation of this vulnerability allows for Server-Side Request Forgery, where an attacker can make the server perform HTTP requests on their behalf, potentially leading to unauthorized access to internal services or data.

Remediation

Users can upgrade to Plunk version 0.7.0 or later to address this vulnerability.