Description

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-11T17:19:06.750Z",
  "pubdate": "2026-08-11T17:19:06.750Z",
  "executiveSummary": "An exposure of Server-Side Request Forgery (SSRF) exists within the webhooks component of Apache Allura prior to version 1.19.1. This vulnerability allows remote actors to manipulate webhook destination parameters, forcing the affected server to initiate unauthorized outbound HTTP requests toward internal network resources or external endpoints. The primary risk implication involves unauthorized information disclosure, interaction with internal microservices, and potential traversal of network segmentation barriers typically inaccessible from the external perimeter. Successful exploitation requires network exposure to the Apache Allura application interface and the capability to configure or trigger webhooks targeting arbitrary URIs. Remediation requires upgrading the Apache Allura deployment to version 1.19.1 or later to enforce strict destination validation mechanisms.",
  "technicalDetails": "The vulnerability resides in the webhooks subsystem of Apache Allura, specifically within the module responsible for dispatching asynchronous HTTP notifications to registered subscriber endpoints. The root cause stems from insufficient input sanitization and a lack of proper destination validation on user-supplied URLs during the webhook creation or triggering phase. Attackers with permissions to configure webhooks can supply arbitrary Uniform Resource Identifiers (URIs), including loopback addresses (127.0.0.1), private Class A, B, and C network ranges (e.g., 10.0.0.0/8, 192.168.0.0/16), or metadata service endpoints utilized in cloud-hosted environments. When the Apache Allura application processes the webhook event, the underlying HTTP client library dereferences the attacker-controlled URL without enforcing adequate egress filtering, protocol restrictions, or DNS resolution checks. The attack flow proceeds as follows: First, the adversary authenticates to the Apache Allura platform and submits a crafted webhook configuration containing a malicious or internal target URI. Second, upon the occurrence of a qualifying repository or project event, the webhook dispatch engine initiates an outbound HTTP connection targeting the specified URI. Third, the Apache Allura server acts as a proxy, querying internal services, fetching local metadata, or interacting with restricted network segments on behalf of the attacker. Finally, the response data from the internal resource may be reflected back via error logs, timing discrepancies, or subsequent application behavior, facilitating reconnaissance or further compromise. The affected software component is Apache Allura before version 1.19.1. Exploitation leverages standard network protocols (HTTP/HTTPS) and relies on the server-side network stack's ability to resolve and connect to internal socket addresses."
}