Description

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-18T16:18:21.133Z",
  "pubdate": "2026-08-18T16:18:21.133Z",
  "executiveSummary": "CodeWhale before 0.8.64 suffers from a Server-Side Request Forgery (SSRF) bypass vulnerability residing within its DNS pinning logic. The flaw stems from an insecure implementation that fails to adequately prevent Time-of-Check-to-Time-of-Use (TOCTOU) race conditions during domain name resolution.\nThe vulnerability allows remote attackers to manipulate DNS responses, causing initial security validation checks to resolve to safe external IP addresses while secondary requests resolve to restricted internal IP addresses.\nSuccessful exploitation bypasses built-in SSRF mitigations, enabling attackers to direct server-side requests toward internal network resources, local loopback interfaces, and metadata services.\nThis risk introduces severe security implications, including unauthorized access to internal infrastructure, potential data exfiltration, and internal service manipulation.\nAttackers require the ability to control or influence authoritative DNS responses for a domain used in targeted requests to successfully exploit the TOCTOU flaw in the affected CodeWhale product versions.",
  "technicalDetails": "The root cause of the vulnerability lies in the DNS pinning mechanism of CodeWhale before version 0.8.64, which enforces a flawed Time-of-Check-to-Time-of-Use validation pattern.\nDuring the initial validation phase (Time-of-Check), the application resolves a target domain name and evaluates the resulting IP address against a set of security rules designed to block internal IP ranges and private networks.\nHowever, because the domain resolution and the actual HTTP request execution are decoupled into separate operations without proper IP pinning enforcement, a secondary resolution occurs during the actual connection phase (Time-of-Use).\nAn attacker leverages this behavior by configuring a malicious authoritative DNS server that returns a safe, publicly routable IP address during the initial validation query, passing the application safety checks.\nImmediately following the check, when the application initiates the actual outbound network connection, the malicious DNS server returns a restricted internal IP address, such as 127.0.0.1 or internal private subnets like 10.0.0.0/8.\nThe underlying network client connects to the newly resolved internal IP address, entirely bypassing the initial SSRF security controls.\nThe vulnerable component is the DNS resolution and pinning validation logic handling outgoing requests within the CodeWhale application.\nThis issue affects all CodeWhale installations prior to version 0.8.64.\nThe attack requires network exposure where the application processes user-supplied URLs, and the attacker must possess control over the DNS records of the requested domain.\nNo specific authentication or high-privilege requirements are inherently necessary if the application exposes functionality that processes arbitrary external URLs supplied by unauthenticated users.\nThe payload behavior forces the server to interact with unintended internal endpoints, potentially disclosing sensitive internal data or triggering unintended state changes on internal services via protocols supported by the request dispatcher."
}