Description

Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T13:18:08.187Z",
  "pubdate": "2026-09-02T13:18:08.187Z",
  "executiveSummary": "The Entity Share Websub module for Drupal is susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to improper validation of user-supplied input during the WebSub subscription or notification process.\nThis vulnerability allows an unauthenticated or authenticated attacker to force the Drupal server to make arbitrary HTTP requests to internal or external resources.\nThe impact includes unauthorized interaction with internal services, potential exfiltration of metadata from cloud-based infrastructure (e.g., AWS/GCP instance metadata services), and the ability to scan local network segments otherwise protected by firewalls.\nThe vulnerability affects all versions of the Entity Share Websub module from 0.0.0 to 1.1.2.\nThe risk is categorized as high, as it enables attackers to bypass network perimeters, potentially leading to information disclosure or reconnaissance of internal network topologies.",
  "technicalDetails": "The root cause of the SSRF vulnerability resides in the insufficient sanitization and validation of URLs provided during the WebSub discovery or subscription handshake phases. The module fails to implement strict allow-lists or URL schema validation, permitting the processing of attacker-supplied destination addresses.\nWhen the module initiates a request to a remote server (e.g., in response to a WebSub callback or discovery request), the underlying HTTP client library performs a request to the user-controlled URI without verifying if the target resolves to a private or loopback IP address (e.g., 127.0.0.1, 169.254.169.254, or internal RFC 1918 ranges).\nThe attack flow typically initiates by an attacker injecting a malicious URL into the module's subscription processing logic. Once the crafted request reaches the server-side, the server acts as a proxy, executing a GET or POST request to the URI specified by the attacker. If the URI points to the local host, the attacker can interact with services bound to the loopback interface, such as administrative panels, databases, or cache instances (e.g., Redis or Memcached) that may rely on local-only access controls.\nFurthermore, if the Drupal installation is hosted in a cloud environment, the SSRF can be leveraged to query cloud-specific metadata services. By crafting a request to the well-known metadata IP address, an attacker may exfiltrate sensitive information, including instance identity documents, temporary IAM security credentials, or environment-specific configuration data.\nThe vulnerability persists throughout the component responsible for processing WebSub protocols. Because the module executes these requests as the web server process, it inherits the permissions and network reach of the Drupal application. The lack of host-based filtering or transport-layer security policies during these outbound requests makes the application a conduit for broader network exploitation, effectively bypassing perimeter defenses."
}