Executive brief
Strapi's webhook feature allows administrators to specify URLs for outbound callbacks. An attacker with admin privileges can input localhost or internal IP addresses, forcing the server to make requests to its own internal ports or services. This enables port scanning and potentially access to sensitive internal services, though it requires elevated administrative access to exploit.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in Strapi's webhook URL input field. The vulnerable component fails to validate or restrict webhook URLs to external destinations, allowing an authenticated admin to specify internal addresses like 127.0.0.1, localhost, or 0.0.0.0. When the webhook is triggered, the Strapi server makes HTTP requests to these internal addresses, enabling port enumeration and potential information disclosure about running services. The vulnerability requires high-privilege admin access and does not allow code execution, but can reveal infrastructure details. Patches are available in version 4.25.2 and later.
Affected products
- Strapi Admin < 4.25.2
Timeline
- 2025-05-27: disclosed
- 2025-05-27: patched: Fixed in version 4.25.2