Description
The /api/cicd/alerts POST endpoint accepts an arbitrary webhookUrl string in the request body and persists it without validating the protocol or target host (no Zod schema or URL format validation in lib/validations.ts).
When a CI/CD event triggers an alert, sendWebhookAlert() in services/github/webhook-handler.ts executes an outbound fetch() request directly to the stored URL. This creates a Server-Side Request Forgery (SSRF) vulnerability allowing authenticated users/clients with the alert secret to force the server to make requests to sensitive internal resources (e.g., cloud metadata endpoints like [http://169.254.169.254/](http://169.254.169.254/), loopback interfaces, or local network services).
Steps to Reproduce
1.Send a POST request to /api/cicd/alerts with a valid CICD_ALERTS_SECRET bearer token.
2.Include an internal or loopback address in the body payload, for example:
{
"repository": "test-repo",
"webhookUrl": "http://169.254.169.254/latest/meta-data/",
"enabled": true
}
3.Trigger a CI alert for the target repository.
4.Observe that the server attempts to issue an outbound HTTP POST request to the specified internal IP address.
Expected Behavior
The API should validate webhookUrl on write:
Strictly enforce https:// protocols.
Reject loopback (127.0.0.0/8), link-local (169.254.0.0/16), and private RFC 1918 IP ranges before persisting or dispatching requests.
Screenshots / Logs
No response
GitHub Username (If applicable)
No response
Environment
Chrome
Description
The
/api/cicd/alertsPOST endpoint accepts an arbitrarywebhookUrlstring in the request body and persists it without validating the protocol or target host (no Zod schema or URL format validation inlib/validations.ts).When a CI/CD event triggers an alert,
sendWebhookAlert()inservices/github/webhook-handler.tsexecutes an outboundfetch()request directly to the stored URL. This creates a Server-Side Request Forgery (SSRF) vulnerability allowing authenticated users/clients with the alert secret to force the server to make requests to sensitive internal resources (e.g., cloud metadata endpoints like[http://169.254.169.254/](http://169.254.169.254/), loopback interfaces, or local network services).Steps to Reproduce
1.Send a
POSTrequest to/api/cicd/alertswith a validCICD_ALERTS_SECRETbearer token.2.Include an internal or loopback address in the body payload, for example:
3.Trigger a CI alert for the target repository.
4.Observe that the server attempts to issue an outbound HTTP POST request to the specified internal IP address.
Expected Behavior
The API should validate
webhookUrlon write:Strictly enforce
https://protocols.Reject loopback (
127.0.0.0/8), link-local (169.254.0.0/16), and private RFC 1918 IP ranges before persisting or dispatching requests.Screenshots / Logs
No response
GitHub Username (If applicable)
No response
Environment
Chrome