Description

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-28T20:20:16.643Z",
  "pubdate": "2026-08-28T20:20:16.643Z",
  "executiveSummary": "Logto, in versions up to and including 1.42.0, is affected by a Server-Side Request Forgery (SSRF) vulnerability within the POST /api/hooks/:id/test endpoint. This vulnerability permits authenticated users with Management API tokens to force the application server to execute arbitrary HTTP POST requests against internal network resources.\nThe vulnerability stems from a lack of input validation regarding the target URL destination, allowing attackers to bypass perimeter security controls. By leveraging this flaw, an attacker can interact with services hosted within the private network that are otherwise inaccessible from the public internet. The potential impact includes unauthorized information disclosure, interaction with internal APIs, and the capability to perform reconnaissance on internal infrastructure.\nExploitation requires valid Management API credentials, limiting the attack surface to tenant administrators. Given the ability to retrieve response bodies from internal services, this vulnerability represents a significant risk to the confidentiality and integrity of the internal network environment.",
  "technicalDetails": "The vulnerability resides in the POST /api/hooks/:id/test endpoint, which is designed to allow administrators to verify webhook configurations by triggering a test request. The root cause of this vulnerability is the absence of host validation or server-side URL sanitization when processing the 'test' target provided in the request payload. The application accepts a user-supplied URL and executes an outbound HTTP POST request to that destination without performing checks to ensure the destination resolves to a public, authorized, or expected endpoint.\nThe attack flow proceeds as follows: An attacker authenticated as a tenant administrator obtains a valid Management API token. The attacker constructs an HTTP POST request targeting the /api/hooks/:id/test endpoint, supplying a URL in the request body that points to an internal resource (e.g., http://127.0.0.1:port/ or an internal metadata service). The Logto server, acting as a proxy, receives this request and initiates an outbound HTTP POST request to the specified internal target. Because the server does not enforce an allowlist or restrict the address space (such as blocking private IP ranges like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16), the internal service receives the request as if it originated from the Logto host itself.\nUpon receiving a response from the internal service, the Logto application processes the response body and returns it to the attacker, effectively completing the SSRF cycle. This mechanism facilitates the exfiltration of sensitive configuration data, internal API secrets, or service-specific metadata. Furthermore, because the attacker can control the request method and potentially the headers/body (depending on the implementation of the test function), they may be able to influence state-changing operations on internal services that trust local traffic or that lack secondary authentication mechanisms.\nThis vulnerability affects Logto up to version 1.42.0. The lack of validation on the URL destination is the primary failure point. The component responsible is the webhook testing service, which acts as an open relay for outbound requests. The severity is exacerbated by the capability to retrieve response bodies, providing immediate feedback to the attacker regarding the success and content of their internal probes."
}