GHSA-89v5-38xr-9m4j

## Summary Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection. ## Vulnerable Code ### 1. Webhook Send Endpoint (Most Critical) **`apps/backend/src/api/routes/webhooks.controller.ts` lines 58-70:** ```typescript async sendWebhook(@Body() body: any, @Query('url') url: string) { try { await fetch(url, { // No URL validation method: 'POST', body: JSON.stringify(body), headers: { 'Content-Type': 'application/json' }, }); } catch (err) { } return { send: true }; } ``` Accepts arbitrary URL via query parameter and fetches directly. ### 2. Stored Webhook Delivery **`apps/orchestrator/src/activities/post.activity.ts` lines 256-281:** ```typescript async sendWebhooks(postId: string, orgId: string, integrationId: string) { const webhooks = await this._webhookService.getWebhooks(orgId); return Promise.all( webhooks.map(async (webhook) => { await fetch(webhook.url, { // Stored URL, no validation method: 'POST', body: JSON.stringify(post), }); }) ); } ``` ### 3. RSS/XML Feed Parser **`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 135:** ```typescript async loadXML(url: string) { const { items } = await parser.parseURL(url); // No URL validation } ``` ### 4. HTML Content Loader **`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 185:** ```typescript async loadUrl(url: string) { const loadDom = new JSDOM(await (await fetch(url)).text()); // No validation } ``` ## Missing Protections - No `request-filtering-agent` or SSRF library - No private IP range filtering - No cloud metadata endpoint blocking - No DNS rebinding protection - URL validation only via `@IsUrl()` decorator (format only, no IP check) ## Attack Scenarios 1. `POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/` → AWS metadata theft 2. `POST /autopost/send?url=