Description

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T22:17:34.250Z",
  "pubdate": "2026-08-31T22:17:34.250Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the Webhook Subscription component of hyperledger-firefly versions up to 1.4.0.\nThe vulnerability resides in the ValidateOptions function within internal/events/webhooks/webhooks.go, where improper validation of the 'url' argument allows attackers to force the server to initiate unauthorized network requests.\nThe risk is critical, as successful exploitation permits an unauthenticated remote attacker to interact with internal network resources or services that are otherwise inaccessible from the public internet.\nBy manipulating the webhook URL, an attacker can perform reconnaissance, probe internal endpoints, or potentially interact with sensitive administrative interfaces exposed within the internal network infrastructure.\nThe availability of public exploit code increases the likelihood of active exploitation, necessitating immediate defensive measures to sanitize input and restrict outbound traffic originating from the FireFly service.",
  "technicalDetails": "The vulnerability is localized to the ValidateOptions function in internal/events/webhooks/webhooks.go, which is responsible for verifying configuration parameters for new webhook subscriptions. The root cause is the lack of robust input validation or denylisting mechanisms for the 'url' parameter before it is processed by the application’s request dispatcher.\nAn attacker can exploit this flaw by providing a malicious URL in the webhook subscription payload. When the Webhook Subscription component processes this input, it fails to enforce strict schema or destination constraints. Consequently, the application interprets the attacker-supplied URL as a legitimate destination for event notifications.\nThe attack flow proceeds as follows: First, the attacker sends a crafted request to the FireFly API to register a new webhook, injecting a targeted internal URI (e.g., http://127.0.0.1:port or http://internal-service/admin) into the 'url' argument. Second, the vulnerable ValidateOptions function validates the input without verifying if the target host is external or restricted.\nThird, once the subscription is active, the FireFly engine triggers an event notification. It performs an outbound HTTP request to the malicious URL specified by the attacker. Because this request originates from the server hosting the hyperledger-firefly instance, it bypasses network perimeter security controls such as firewalls or network access control lists (ACLs) that would normally protect internal services.\nThe impact of this SSRF is significant, as the server acts as a proxy for the attacker. Depending on the environment, this could lead to sensitive data exfiltration if the attacker targets internal metadata services or management APIs. Furthermore, the attacker may leverage this primitive to conduct port scanning of the internal infrastructure to identify vulnerable services. Because the exploit code is public and requires no specialized authentication or complex privileges, it represents a high-impact, easily accessible attack vector for remote threat actors."
}