Description

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-11-05T19:17:19.693Z",
  "pubdate": "2026-11-05T19:17:19.693Z",
  "executiveSummary": "Posta versions prior to v0.18.0 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability originating from improper validation of user-supplied webhook URLs. This flaw allows an authenticated user with edit privileges to manipulate the backend application into issuing arbitrary HTTP POST requests to internal network resources.\nThe vulnerability poses a significant security risk by enabling attackers to bypass network perimeters, potentially interacting with loopback services, private network segments, or sensitive cloud instance metadata endpoints. By observing the delivery status codes and error strings returned by the application, an attacker can conduct internal reconnaissance, port scanning, and service enumeration.\nExploitation requires valid user credentials with sufficient privileges to modify or create webhook configurations. Once authenticated, the attacker can submit crafted URLs that point to protected internal infrastructure. The lack of an allowlist or comprehensive URI validation mechanism for webhook destinations facilitates this unauthorized outbound traffic generation, effectively turning the application into a proxy for internal network exploitation.\nThis vulnerability highlights the critical importance of restricting outbound network access for application components and implementing robust validation for service integration endpoints to prevent unauthorized resource interaction within protected network boundaries.",
  "technicalDetails": "The vulnerability resides in the webhook configuration module of Posta, specifically where the system processes and stores URLs for event notifications. The root cause is the absence of comprehensive input validation or filtering on these URLs, which allows them to bypass intended network constraints.\nThe exploitation flow begins with an authenticated attacker, possessing edit-level access, who navigates to the webhook configuration interface. The attacker defines a new webhook or modifies an existing one, supplying an arbitrary target URL. When the application triggers an event notification, it initiates an outgoing HTTP POST request to the attacker-defined address using its internal network stack.\nBecause the server does not enforce network segmentation or URI schemes, the backend can be induced to contact endpoints that are normally inaccessible from the external network. Specifically, this includes the loopback interface (e.g., http://127.0.0.1), private RFC1918 subnets, and cloud infrastructure metadata services (such as the AWS Instance Metadata Service at 169.254.169.254).\nUpon transmission of the POST request, the Posta backend captures the HTTP response, including status codes, headers, and error messages (e.g., connection refused, timeout, or specific service responses). The attacker leverages these diagnostic feedback mechanisms as a side-channel to perform network mapping. By observing differences in delivery feedback—such as distinguishing between a 404 Not Found, a 403 Forbidden, or a connection timeout—the attacker can infer the presence, state, and type of services running on the internal network.\nThe scope of impact is critical, as it enables an authenticated user to perform blind or semi-blind SSRF attacks to identify internal infrastructure and potential secondary targets for further exploitation. This capability facilitates lateral movement within the hosting environment, as the attacker can probe services that rely on implicit trust based on network locality. Posta versions prior to v0.18.0 are definitively affected. The lack of an integrated mechanism to validate destination hosts against a pre-defined allowlist or to restrict the application's network access via firewall or OS-level controls renders the backend vulnerable to this abuse by any actor with sufficient authorization to manipulate webhook settings."
}