Skip to content

Commit cefeb6d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-89v5-38xr-9m4j GHSA-vj2p-7pgw-g2wf
1 parent ab1c5a2 commit cefeb6d

2 files changed

Lines changed: 131 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-89v5-38xr-9m4j/GHSA-89v5-38xr-9m4j.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-89v5-38xr-9m4j",
4+
"modified": "2026-03-27T15:47:57Z",
5+
"published": "2026-03-27T15:47:57Z",
6+
"aliases": [],
7+
"summary": "Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader",
8+
"details": "## Summary\n\nPostiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection.\n\n## Vulnerable Code\n\n### 1. Webhook Send Endpoint (Most Critical)\n\n**`apps/backend/src/api/routes/webhooks.controller.ts` lines 58-70:**\n```typescript\nasync sendWebhook(@Body() body: any, @Query('url') url: string) {\n try {\n await fetch(url, { // No URL validation\n method: 'POST',\n body: JSON.stringify(body),\n headers: { 'Content-Type': 'application/json' },\n });\n } catch (err) { }\n return { send: true };\n}\n```\n\nAccepts arbitrary URL via query parameter and fetches directly.\n\n### 2. Stored Webhook Delivery\n\n**`apps/orchestrator/src/activities/post.activity.ts` lines 256-281:**\n```typescript\nasync sendWebhooks(postId: string, orgId: string, integrationId: string) {\n const webhooks = await this._webhookService.getWebhooks(orgId);\n return Promise.all(\n webhooks.map(async (webhook) => {\n await fetch(webhook.url, { // Stored URL, no validation\n method: 'POST',\n body: JSON.stringify(post),\n });\n })\n );\n}\n```\n\n### 3. RSS/XML Feed Parser\n\n**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 135:**\n```typescript\nasync loadXML(url: string) {\n const { items } = await parser.parseURL(url); // No URL validation\n}\n```\n\n### 4. HTML Content Loader\n\n**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 185:**\n```typescript\nasync loadUrl(url: string) {\n const loadDom = new JSDOM(await (await fetch(url)).text()); // No validation\n}\n```\n\n## Missing Protections\n\n- No `request-filtering-agent` or SSRF library\n- No private IP range filtering\n- No cloud metadata endpoint blocking\n- No DNS rebinding protection\n- URL validation only via `@IsUrl()` decorator (format only, no IP check)\n\n## Attack Scenarios\n\n1. `POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/` → AWS metadata theft\n2. `POST /autopost/send?url=http://127.0.0.1:6379` → Internal Redis access\n3. Create webhook with `http://10.0.0.1:8080/admin` → Internal service access on post publish\n\n## Impact\n\n- **Cloud metadata theft**: AWS/GCP/Azure credentials\n- **Internal network scanning**: Full access to private IP ranges\n- **Multiple entry points**: Webhooks, RSS feeds, URL loader all vulnerable",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "postiz"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "2.0.12"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-89v5-38xr-9m4j"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/gitroomhq/postiz-app/commit/0ad89ccd26b1c387c4f3f3544b18c20d33586466"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/gitroomhq/postiz-app/commit/be5d871896e97cb1f5a2c9241f156b6a1e1debe8"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/gitroomhq/postiz-app"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.2"
56+
}
57+
],
58+
"database_specific": {
59+
"cwe_ids": [
60+
"CWE-918"
61+
],
62+
"severity": "HIGH",
63+
"github_reviewed": true,
64+
"github_reviewed_at": "2026-03-27T15:47:57Z",
65+
"nvd_published_at": null
66+
}
67+
}

‎advisories/github-reviewed/2026/03/GHSA-vj2p-7pgw-g2wf/GHSA-vj2p-7pgw-g2wf.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vj2p-7pgw-g2wf",
4+
"modified": "2026-03-27T15:46:53Z",
5+
"published": "2026-03-27T15:46:53Z",
6+
"aliases": [],
7+
"summary": "Postiz App has a High-Severity SSRF Vulnerability via Next.js",
8+
"details": "### Impact\nA successful SSRF attack allows an attacker to:\n- Bypass firewalls to scan and interact with internal network services/ports.\n- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.\n- Pivot into the internal network environment where Postiz is hosted.\n\n### Workarounds\nThere are no workarounds known to this, please upgrade to Postiz version `v2.21.1`.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "postiz"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "2.0.12"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-vj2p-7pgw-g2wf"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g"
44+
},
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34351"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/gitroomhq/postiz-app"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-1395",
57+
"CWE-918"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-03-27T15:46:53Z",
62+
"nvd_published_at": null
63+
}
64+
}

0 commit comments

Comments
 (0)