Description

A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T22:16:48.300Z",
  "pubdate": "2026-08-06T22:16:48.300Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists within WGDashboard version 4.2.3 and earlier. This security flaw resides in the webhook functionality of the application, which fails to adequately validate or sanitize user-supplied URLs prior to initiating outbound HTTP requests. Consequently, authenticated malicious actors can exploit this weakness to force the server into issuing arbitrary HTTP requests to internal or external destinations and subsequently retrieving the resulting responses. The primary risk implication involves unauthorized interaction with internal network resources that are normally shielded from direct external access, potentially leading to information disclosure or further internal network penetration. Exploitation of this vulnerability requires the attacker to possess authenticated access to the WGDashboard application, enabling them to interact with the vulnerable webhook feature. The combination of arbitrary request generation and response retrieval broadens the attack surface of the hosting environment, allowing authenticated users to abuse administrative or feature-specific capabilities for unintended data retrieval and network reconnaissance.",
  "technicalDetails": "The vulnerability is classified as a Server-Side Request Forgery (SSRF) flaw, located specifically within the webhook functionality of WGDashboard version 4.2.3 and earlier. The root cause stems from insufficient input validation and lack of domain or IP address restriction checks on URLs processed by the webhook feature. When an authenticated user submits a crafted URL through the vulnerable webhook interface, the application backend fails to restrict the destination to authorized external endpoints or validate the scheme against safe protocols.\nThe attack flow proceeds as follows: First, the attacker establishes an authenticated session within the WGDashboard application. Second, the attacker navigates to the webhook configuration or trigger interface. Third, instead of supplying a legitimate external webhook destination, the attacker inputs a malicious payload containing a targeted internal URL (such as loopback addresses, internal service IPs, or metadata service endpoints) or an arbitrary external URI. Fourth, the server-side component processes this input and initiates an outbound HTTP request directly from the host running WGDashboard to the specified target. Finally, the application captures the response returned by the targeted resource and exposes it back to the authenticated attacker, thereby breaching network segmentation boundaries and leaking potentially sensitive data.\nThe affected component is the webhook subsystem handling outbound HTTP communications. Exploitation requires authenticated access to the application, although specific high-level administrative privileges beyond standard authenticated interaction may or may not be enforced depending on the precise feature configuration. The network exposure of the vulnerability is tied to the application interface, but the secondary impact extends to internal networks reachable from the server hosting WGDashboard. Payload behavior involves instructing the underlying HTTP client library to query unintended endpoints, potentially interacting with internal microservices, databases, or cloud metadata APIs. The post-exploitation impact includes unauthorized reading of internal application responses, network mapping, and potential cascading exploitation of vulnerable internal services."
}