Hemmelig
Monthly
Server-side request forgery filter bypass in Hemmelig versions prior to 7.3.3 allows an authenticated user to direct the server to make HTTP requests to internal or private network resources by supplying a webhook URL in the Secret Requests feature that uses a DNS-rebinding domain such as localtest.me (which resolves to 127.0.0.1) or an open-redirect service such as httpbin.org/redirect-to. The pre-7.3.3 isPublicUrl validation only compared the literal hostname string against a regex blocklist and the HTTP client followed redirects, so neither the resolved IP nor the redirect target was ever checked. Exploitation requires an authenticated account (CVSS PR:L) and the webhook must actually fire when a secret is submitted; the assessed impact is limited (CVSS 4.3, C:L/I:N/A:N) because the attacker cannot read the response, only trigger requests to reachable internal services. Publicly available exploit code exists, and the vendor-released patch is 7.3.3.
Server-side request forgery filter bypass in Hemmelig versions prior to 7.3.3 allows an authenticated user to direct the server to make HTTP requests to internal or private network resources by supplying a webhook URL in the Secret Requests feature that uses a DNS-rebinding domain such as localtest.me (which resolves to 127.0.0.1) or an open-redirect service such as httpbin.org/redirect-to. The pre-7.3.3 isPublicUrl validation only compared the literal hostname string against a regex blocklist and the HTTP client followed redirects, so neither the resolved IP nor the redirect target was ever checked. Exploitation requires an authenticated account (CVSS PR:L) and the webhook must actually fire when a secret is submitted; the assessed impact is limited (CVSS 4.3, C:L/I:N/A:N) because the attacker cannot read the response, only trigger requests to reachable internal services. Publicly available exploit code exists, and the vendor-released patch is 7.3.3.