Description

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-04T15:17:44.543Z",
  "pubdate": "2026-09-04T15:17:44.543Z",
  "executiveSummary": "The vulnerability identified in xiaobei through version 5.5.2 involves critical security flaws within the application's webhook handling mechanism.\nThe primary vulnerability stems from a lack of authentication and signature validation on webhook endpoints, specifically the /webhook_worktool handler.\nThis failure allows unauthenticated remote attackers to inject arbitrary messages directly into the agent pipeline, bypassing intended security controls.\nFurthermore, the application performs insecure fetching of media URLs provided via these webhooks, enabling Server-Side Request Forgery (SSRF) attacks.\nAn attacker can leverage these combined flaws to manipulate internal agent workflows and probe or interact with internal services that are otherwise protected from the public internet.\nThe risk implication is high, as it grants unauthorized actors the ability to influence internal data processing, potentially leading to unauthorized actions within the environment and exposure of internal network infrastructure.",
  "technicalDetails": "The vulnerability resides in the /webhook_worktool endpoint of the xiaobei application, which is present in all versions up to and including 5.5.2.\nThe root cause is the absence of cryptographic signature verification or session-based authentication requirements for incoming webhook requests. By design, a webhook endpoint should verify the authenticity of a request using a pre-shared secret or a signature header (e.g., HMAC-SHA256). In this implementation, the endpoint accepts any HTTP POST request without verifying its origin or integrity.\nExploitation involves the injection of crafted malicious payloads into the agent pipeline. Because the application blindly trusts the content of these requests, an attacker can effectively impersonate legitimate service providers or internal systems to inject arbitrary tasks or messages. Once the message is accepted by the pipeline, it is processed as if it originated from a trusted source, allowing for arbitrary logic execution within the agent's context.\nThe secondary vector involves Server-Side Request Forgery (SSRF). The application processes media URLs contained within the injected webhook messages. Because the server fetches these URLs without strict validation or allowlisting of target destinations, the attacker can specify internal IP addresses or restricted service URLs (e.g., http://127.0.0.1:8080 or http://internal-metadata-service). The server, acting as a proxy, performs the request to the specified resource, returning the response—or its effects—back to the attacker or executing actions on the internal network.\nThe attack flow follows these steps: 1) The attacker identifies the exposed /webhook_worktool endpoint. 2) The attacker constructs a malicious payload containing an arbitrary message or a target URL for SSRF. 3) The attacker sends a crafted POST request to the endpoint. 4) The server accepts the payload without authentication, pushing the arbitrary message to the pipeline or initiating an outbound request to the target URI. 5) The server-side code resolves the target URI, effectively facilitating unauthorized interaction with internal network resources."
}