CyberRota Analysis
AI-GeneratedWallos versions prior to 4.9.6 are vulnerable to Server-Side Request Forgery (SSRF) due to inadequate validation of user-supplied SMTP address and port in the email notification endpoint. This flaw allows authenticated users to probe internal networks and access sensitive cloud metadata, potentially leading to significant data exposure. Organizations using Wallos should prioritize upgrading to version 4.9.6 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network, cloud metadata. This issue has been patched in version 4.9.6.