Executive brief
Fireshare is a self-hosted media and file sharing platform. Two API endpoints that test webhook integrations lack proper authentication controls, allowing any unauthenticated attacker to make arbitrary HTTP POST requests from the Fireshare server to any internal or external destination. This enables attackers to probe internal networks, access cloud metadata services to steal credentials, and bypass firewalls using the Fireshare instance as a proxy.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) caused by missing @login_required decorators on two Flask API endpoints: POST /api/test-discord-webhook and POST /api/test-webhook in app/server/fireshare/api/misc.py. The endpoints accept attacker-supplied webhook URLs and make unconditional requests.post() calls without URL validation, scheme restrictions, or allowlisting. An unauthenticated attacker can POST a malicious webhook_url parameter to reach internal services (127.0.0.1, 169.254.169.254 in AWS), Docker-local services, or external attacker-controlled servers. The underlying send_discord_webhook() and send_generic_webhook() functions in cli.py perform no filtering. Versions prior to 1.6.16 are affected; the fix adds the @login_required decorator to both endpoints, preventing unauthenticated access.
Affected products
- ShaneIsrael Fireshare prior to 1.6.16
Timeline
- 2026-06-10: disclosed
- 2026-09-15: advisory
- 2026-09-15: patched: Fix released in version 1.6.16