Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destination…
Medium CVSS 6.3
Summary
Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-5p3m-vhh6-9236
- https://www.vulncheck.com/advisories/stigmem-before-0a11-ssrf-via-unvalidated-webhook-delivery-address
- https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-5p3m-vhh6-9236
Timeline
- nvd_ingest NVD