Executive brief
The Grav API plugin's webhook feature is vulnerable to a server-side request forgery (SSRF) attack that allows attackers to access internal network resources. An attacker with webhook configuration permissions can exploit DNS rebinding to bypass hostname validation checks and cause the server to send requests to private internal addresses, potentially exposing sensitive data from internal systems.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in the WebhookDispatcher::httpPost() method. The code validates that a webhook hostname resolves to a public address, but then passes the hostname to cURL for delivery, which performs an independent DNS lookup. An attacker controlling authoritative DNS for the configured hostname can respond with a public address during validation and a private address during delivery, bypassing the SSRF guard. Exploitation requires api.webhooks.write permission and control of authoritative DNS with low TTL, making it probabilistic and requiring multiple attempts. The vulnerability is fixed in version 1.0.16 by resolving the hostname once and pinning the validated addresses to the connection.
Affected products
- Grav API plugin before 1.0.16
Timeline
- 2026-08-10: disclosed: GitHub Security Advisory GHSA-hq2v-cgw4-fw2w published
- 2026-08-10: patched: Fix released in version 1.0.16
- 2026-08-25: other: CVE-2026-56708 assigned (NVD publication date)