Description

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-13T11:17:01.270Z",
  "pubdate": "2026-09-13T11:17:01.270Z",
  "executiveSummary": "Open Notebook versions prior to 1.11.0 are susceptible to a critical Server-Side Request Forgery (SSRF) vulnerability. The flaw exists within the /api/sources endpoint, which fails to adequately sanitize or validate user-supplied URL parameters before initiating backend HTTP requests.\nThis vulnerability allows an authenticated attacker to force the application server to perform arbitrary outbound HTTP requests to internal network segments, cloud metadata services, and local loopback interfaces. By leveraging the server's identity and network position, attackers can bypass perimeter security controls, potentially exfiltrating sensitive internal data or interacting with restricted services that are not exposed to the public internet.\nThe risk implication is high, as the capability to probe internal infrastructure often serves as a pivot point for broader network compromise or lateral movement. Exploitation requires authenticated access to the application, but given the nature of the endpoint, this could be achieved through compromised standard user accounts. Security teams should prioritize patching or implementing strict egress traffic controls to mitigate the impact of this SSRF vector.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within the /api/sources endpoint of Open Notebook. When a request is submitted to this endpoint, the application extracts the 'URL' parameter and uses it to initiate a direct HTTP request from the server-side environment. Because the application fails to implement a robust allow-list of permitted domains or destination IPs, the underlying HTTP client is vulnerable to manipulation.\nThe exploitation flow begins when an authenticated user sends a crafted POST request to the /api/sources endpoint. By modifying the URL parameter to point to sensitive internal targets, the attacker can force the server to behave as a proxy. For cloud-hosted instances, an attacker might target the Cloud Metadata Service (e.g., http://169.254.169.254) to retrieve IAM credentials, instance identity documents, or sensitive environment configuration variables.\nBeyond cloud metadata, the vulnerability permits the enumeration and interaction with internal services that are bound to 'localhost' or accessible via the application server's private network interface. This includes internal management APIs, database services, or cached application states that rely on the assumption of network isolation. The application effectively acts as a blind proxy, where the response or the side effects of the request (such as status codes or timing variations) can be used to map the internal network topology.\nThe vulnerable component is identified as the backend processing logic responsible for external resource ingestion within the /api/sources API. This impacts all versions of Open Notebook prior to 1.11.0. Exploitation does not require elevated administrative privileges, only valid authentication, making it accessible to any user with legitimate access to the application interface. Post-exploitation impact may include the compromise of cloud service roles, sensitive data exfiltration, or the unauthorized modification of internal service states if those services lack secondary authentication mechanisms independent of the application server."
}