Repository navigation
[Backend] Webhook subscriptions accept any URL, enabling SSRF to internal services #3
Description
Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0
Why this matters
Webhook registration in src/controllers/indexerController.ts (lines 494-520) only validates that callbackUrl parses and uses http/https. There is no block on loopback, link-local (169.254.169.254), or RFC1918 ranges, so an authenticated caller can make the indexer POST to internal services or cloud metadata endpoints.
Acceptance criteria
- Reject callback URLs that resolve to loopback, link-local, RFC1918 or other reserved ranges at registration time
- Re-validate the resolved address at delivery time in webhookService to defend against DNS rebinding
- Add tests covering 127.0.0.1, 169.254.169.254 and a 10.x host being rejected
- Document the allowed/blocked URL policy
Files to touch
- src/controllers/indexerController.ts
- src/services/webhookService.ts
Out of scope
- Building an allowlist UI
- Outbound proxy infrastructure
Activity
System625 commentedon Jun 17, 2026
I am writing to express my interest in resolving the SSRF vulnerability in the webhook subscription system.
With a strong background in backend security and Node.js development, I will implement rigorous URL and IP validation within
indexerController.tsandwebhookService.ts. To eliminate the risk of SSRF and DNS rebinding attacks, I will integrate a secure IP resolution check that explicitly blocks loopback (127.0.0.1), link-local (169.254.169.254), RFC1918 private networks, and other reserved ranges at both registration and delivery time.I will write comprehensive test suites to validate these defenses against malicious payloads and fully document the new URL policy. I am ready to secure this pipeline immediately.
Amarjeet325 commentedon Jun 19, 2026
Hi, maintainers 👋.
I’d like to work on this issue.
I’m a full-stack developer and smart contract expert; I have previously contributed to multiple open-source projects.
Could you please assign this issue to me?
grantfox-oss commentedon Jun 20, 2026
🦊 GrantFox — @System625 has been assigned to this issue as part of the Official Campaign campaign!
Next steps:
Closes #3)Good luck! Track your progress on GrantFox.
grantfox-oss commentedon Jul 1, 2026
🎉 This issue has been marked as completed on GrantFox!
@System625's PR #43 was approved and merged by @ogazboiz.
🏆 @System625: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (121 total points). Track your full progress on GrantFox.
👏 Great work, @System625! Keep contributing to LabsCrypt.