Description

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSRF guard validates a hostname's resolved IP addresses but discards them before the actual HTTP connection is opened, allowing an attacker who controls authoritative DNS to return a public address during validation and a private address during the subsequent independent socket-level DNS resolution, causing the guard to pass while the outbound connection reaches internal infrastructure such as cloud instance metadata endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-19T17:21:13.430Z",
  "pubdate": "2026-08-19T17:21:13.430Z",
  "executiveSummary": "The vulnerability identified inkeeper.sh's calendar module represents a severe Server-Side Request Forgery (SSRF) guard bypass flaw residing within its URL validation and connection architecture. Specifically affecting versions prior to 2.18.14, this security defect permits authenticated malicious actors to successfully pivot outbound HTTP requests toward restricted private network addresses and internal infrastructure.\nThe primary impact of this vulnerability involves unauthorized network traversal, potentially granting attackers access to sensitive internal resources such as cloud instance metadata endpoints. The attack leverages a DNS rebinding technique targeting a decoupled, two-phase validation and connection flow.\nExploitation requires authenticated access to the application alongside attacker control over an authoritative DNS server capable of dynamically altering DNS responses. Given the capability to bypass built-in SSRF protections, this vulnerability introduces significant risk to the confidentiality and integrity of internal cloud environments and enterprise infrastructure hosting the affected keeper.sh calendar module.",
  "technicalDetails": "The root cause of this vulnerability stems from a race condition and architectural flaw in the decoupling of host validation and socket connection phases within keeper.sh's calendar module prior to version 2.18.14. The vulnerable component is the internal URL validation and outbound HTTP request handling logic.\nThe attack flow proceeds in a distinct two-phase sequence. In the first phase, the application's SSRF guard intercepts a user-supplied URL and performs an initial hostname resolution to evaluate the target IP addresses. Because the guard validates these resolved IP addresses against a blacklist or private IP range filter, the attacker configures their controlled authoritative DNS server to return a safe, publicly routable IP address during this initial validation check. Consequently, the SSRF guard validation logic passes successfully.\nIn the second phase, the application discards the validated IP addresses rather than retaining and reusing them for the subsequent outbound connection. Instead, the application initiates an independent, socket-level DNS resolution right before opening the actual HTTP connection. Taking advantage of this design flaw, the attacker's authoritative DNS server dynamically switches the response, returning a restricted private network address or loopback address during this second resolution step.\nAs a result of this DNS rebinding behavior, the outbound HTTP connection is established directly with internal infrastructure, such as cloud instance metadata services, internal microservices, or private segment APIs. This architecture enables attackers with standard authentication privileges to completely subvert IP-based SSRF defenses and read sensitive internal data."
}