EUVD-2026-56037
GHSA-gfrj-pxwg-9r69
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Webhook registration is network-accessible and syntactically trivial (AC:L); consumer-role authentication required (PR:L); no integrity or availability impact described; confidentiality high given reachability of cloud metadata and internal APIs.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via FILTER_VALIDATE_URL but applies no IP or host denylist. When the registered event fires, the server issues an HTTP POST to the attacker-supplied internal URL.
AnalysisAI
Server-side request forgery in Apioo Fusio 8.8.3 enables authenticated consumer-role users to direct the application server to issue arbitrary HTTP POST requests to internal network addresses by registering a crafted webhook URL. The root cause is insufficient input validation: the webhook registration endpoint applies PHP's FILTER_VALIDATE_URL for syntactic URL checking but enforces no IP or host denylist to block private RFC 1918 ranges, loopback, or link-local addresses. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Technical ContextAI
Fusio is an open-source API management and backend-as-a-service framework developed by Apioo (CPE: cpe:2.3:a:apioo:fusio:*:*:*:*:*:*:*:*). The vulnerability class is CWE-918 (Server-Side Request Forgery), in which the server acts as a proxy to reach network destinations not directly accessible to the attacker. The specific trigger is the webhook registration feature, where a consumer-role user supplies a callback URL. PHP's FILTER_VALIDATE_URL validates only syntactic URL correctness - it does not resolve hostnames or evaluate the resulting IP address against blocklists, permitting hostnames that resolve to 127.0.0.1, 169.254.169.254 (cloud instance metadata), or RFC 1918 ranges to pass validation unchallenged. When the registered event fires, Fusio performs an HTTP POST to the attacker-supplied URL from the application host's server-side network position, bypassing perimeter controls that would otherwise block the attacker from reaching those internal addresses directly.
RemediationAI
No vendor-released patch has been independently confirmed at time of analysis; the only reference provided points to the upstream GitHub repository at https://github.com/apioo/fusio, which should be monitored for tagged releases or a formal security advisory. As a primary compensating control, administrators should implement an IP-based denylist at the application or egress-firewall layer that blocks webhook deliveries to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16); note that hostname-based checks alone are insufficient due to DNS rebinding, so IP resolution must be validated at the time of the outbound request. Restricting the consumer role from registering webhooks via Fusio's built-in scope and role configuration eliminates the attack vector entirely, at the cost of disabling webhook functionality for those users. Network-level egress filtering on the Fusio host to block outbound connections to internal subnets provides a defense-in-depth layer independent of application logic and should be treated as a baseline hardening measure regardless of patch availability.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today