Api Service
Monthly
Cross-environment integration tampering in Novu before 3.18.0 lets an authenticated caller who holds an environment-scoped API key or a dashboard (JWT) session for one environment act on an integration that belongs to a different environment within the same organization, deleting it, rewriting its provider credentials, promoting it to primary, or triggering auto-configuration by supplying the target environment's integrationId. The advisory-defined scope covers both environment API keys and dashboard sessions, but the v3.18.0 release closes only the environment-scoped API-key path (HTTP 403, 'is scoped to a single environment') while its own tests deliberately preserve cross-environment dashboard-session behavior, so 3.18.0 is a partial remediation and installations at or above that version remain exposed through the JWT/dashboard vector. Severity is moderate (CVSS 6.5, CWE-639): integrity and availability are fully impacted while confidentiality is not, no cross-organization access is possible, exploitation requires existing authenticated access plus knowledge or enumeration of a target integrationId, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Novu prior to 3.18.0 allows an authenticated user to make the notification worker issue attacker-directed POST requests to internal or otherwise restricted network services by supplying a chat webhook URL through subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl. The Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip chat providers pass that URL straight into raw HTTP requests in send-message-chat.usecase.ts without the normalizeOutboundHttpUrl, assertSafeOutboundUrl, or DNS-pinned safeOutboundJsonRequest guards that protect Novu's generic webhook providers, resulting in a largely blind, POST-only SSRF whose impact is bounded to interactions or actions offered by the reached internal service (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid authenticated account and worker-level network reachability to the intended target; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (CISA KEV). The issue is fixed in version 3.18.0.
Cross-environment integration tampering in Novu before 3.18.0 lets an authenticated caller who holds an environment-scoped API key or a dashboard (JWT) session for one environment act on an integration that belongs to a different environment within the same organization, deleting it, rewriting its provider credentials, promoting it to primary, or triggering auto-configuration by supplying the target environment's integrationId. The advisory-defined scope covers both environment API keys and dashboard sessions, but the v3.18.0 release closes only the environment-scoped API-key path (HTTP 403, 'is scoped to a single environment') while its own tests deliberately preserve cross-environment dashboard-session behavior, so 3.18.0 is a partial remediation and installations at or above that version remain exposed through the JWT/dashboard vector. Severity is moderate (CVSS 6.5, CWE-639): integrity and availability are fully impacted while confidentiality is not, no cross-organization access is possible, exploitation requires existing authenticated access plus knowledge or enumeration of a target integrationId, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Novu prior to 3.18.0 allows an authenticated user to make the notification worker issue attacker-directed POST requests to internal or otherwise restricted network services by supplying a chat webhook URL through subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl. The Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip chat providers pass that URL straight into raw HTTP requests in send-message-chat.usecase.ts without the normalizeOutboundHttpUrl, assertSafeOutboundUrl, or DNS-pinned safeOutboundJsonRequest guards that protect Novu's generic webhook providers, resulting in a largely blind, POST-only SSRF whose impact is bounded to interactions or actions offered by the reached internal service (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid authenticated account and worker-level network reachability to the intended target; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (CISA KEV). The issue is fixed in version 3.18.0.