welovemedia FFmate Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in welovemedia FFmate versions through 2.0.15. The issue arises in the webhook functionality, where user-controlled URLs are used to initiate HTTP requests without proper validation. This vulnerability allows attackers to direct webhook requests to internal resources, potentially probing network services, accessing restricted metadata endpoints, bypassing firewall rules, scanning internal ports, and exfiltrating sensitive data from otherwise inaccessible services.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where the application is tricked into making requests to internal resources on behalf of the attacker. This could lead to probing internal services, accessing sensitive data, or bypassing firewall restrictions.

Reproduction

To reproduce this vulnerability, create a webhook that points to an internal resource, such as a Flask server running on localhost. Once the webhook is triggered, the Flask server will log the request, demonstrating that the internal resource was accessed by the server.