CyberRota Analysis
AI-GeneratedThe vulnerability affects the Ech0 product versions up to 4.2.1, specifically in the validateWebhookURL function, which inadequately validates hostnames, allowing an attacker with admin privileges to exploit server-side request forgery (SSRF). This flaw could enable unauthorized access to internal services and cloud metadata endpoints, posing a risk to sensitive data and network resources. Organizations using affected versions should prioritize patching to version 4.4.3 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates literal IP addresses via net.ParseIP() and fails to reject hostnames that DNS-resolve to private or internal IPs (e.g., 169.254.169.254.nip.io). An attacker with admin privileges can create a webhook with such a hostname to bypass validation and cause the server to make requests to internal services, cloud metadata endpoints, and private network resources. The issue is fixed in 4.4.3.