Casdoor Webhook URL Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in Casdoor version 2.356.0. This issue arises in the Webhook URL Handler component, where the application fetches admin-configured webhook URLs without proper validation. As a result, an attacker with organization-admin access could manipulate the webhook to target internal services or cloud metadata endpoints, potentially exfiltrating sensitive information or scanning internal infrastructure.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server send requests to internal services or external endpoints, bypassing network restrictions and potentially accessing sensitive data or services.

Remediation

No known mitigation is available for this vulnerability.