Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/payments/search.php — that was not given the same hardening. It still passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY. This issue has been patched in version 5.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-31T22:17:20.317Z",
  "pubdate": "2026-08-31T22:17:20.317Z",
  "executiveSummary": "Wallos versions prior to 5.0.0 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability located in the endpoints/payments/search.php component. This flaw arises from the insecure handling of HTTP_PROXY and HTTPS_PROXY environment variables during cURL operations.\nThe vulnerability allows an unauthenticated, remote attacker to manipulate the underlying HTTP proxy configuration, effectively bypassing network access controls. By leveraging this mechanism, an attacker can coerce the Wallos server into performing arbitrary outbound HTTP requests on their behalf. This primitive can be weaponized to interact with internal services that are otherwise unreachable from the public internet, perform port scanning of the internal infrastructure, or facilitate exfiltration of sensitive metadata from cloud-based environments (e.g., IMDS).\nThis issue represents a failure to apply consistent security hardening across similar endpoints, as a previous mitigation for CVE-2026-33407 addressed a near-identical flaw in endpoints/logos/search.php but omitted the secondary payments search module. Given the lack of authentication required to trigger the request, the risk is classified as critical, necessitating an immediate upgrade to version 5.0.0 or later to ensure proper suppression of proxy configuration within cURL handles.",
  "technicalDetails": "The root cause of this vulnerability is the improper configuration of the cURL library within the endpoints/payments/search.php file of the Wallos application. The application utilizes cURL to fetch external logo images; however, it fails to explicitly disable or sanitize proxy environment variables.\nIn environments where the HTTP_PROXY or HTTPS_PROXY environment variables are defined, the cURL implementation automatically inherits these settings. Because the code does not initialize the CURLOPT_PROXY option to an empty string or set CURLOPT_NOPROXY to '*'—as was done in the patched version of endpoints/logos/search.php—the library respects the environment variables, effectively routing outgoing requests through an attacker-controlled or arbitrary proxy server.\nThe attack flow begins when an unauthenticated user sends a specially crafted request to the endpoints/payments/search.php script. The script processes the input and initiates a cURL request to a user-defined URL. Because the proxy configuration is not hardcoded to ignore environment settings, the system uses the defined proxy to perform the fetch. By setting the environment variables (often achieved in containerized or shared-hosting environments where such variables might persist or be injectable), an attacker can force the application to make requests to internal network segments.\nThis allows for blind or semi-blind SSRF, where the attacker can probe internal IP addresses and ports to identify active services (e.g., redis, databases, or internal APIs). Furthermore, because the proxy configuration is applied globally to the cURL handle, the attacker can redirect the internal request to an arbitrary host. If the infrastructure relies on metadata services (such as 169.254.169.254 in AWS/GCP/Azure environments), the attacker could potentially retrieve sensitive configuration data or temporary security credentials by forcing the server to issue requests to these specific endpoints.\nThe vulnerability is present in all versions prior to 5.0.0. Unlike the previous remediation for CVE-2026-33407, which correctly enforced security boundaries, this specific endpoint remained exposed due to an oversight in the application's patch management cycle. The exploitation requires no privileges and can be performed from any network location capable of reaching the Wallos instance, provided the server environment has proxy variables configured or is otherwise susceptible to proxy-based request redirection."
}