Executive brief
Stoatchat, an open-source communication platform, contains a security flaw in its 'January' media proxy and embed service. This vulnerability allows an unauthorized person to trick the server into making requests to internal systems that should be private, such as internal databases or cloud metadata services. This could lead to the exposure of sensitive internal data or credentials, potentially compromising the entire server infrastructure.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the 'January' service of stoatchat (specifically the /proxy and /embed endpoints) due to incomplete DNS resolution validation. The 'url_is_blacklisted' function in 'crates/services/january/src/requests.rs' only validates the first IP address returned by a DNS query. However, the underlying HTTP client (reqwest) iterates through all resolved addresses if the first one fails. An attacker can exploit this by providing a hostname that resolves to multiple A records: an unreachable public IP (to pass the check) followed by a restricted internal or loopback IP. This allows unauthenticated network-accessible attackers to bypass the IP blocklist and reach internal services, including instance metadata endpoints (IMDS) in cloud environments. The issue is fixed in version 0.14.0.
Affected products
- stoatchat stoatchat < 0.14.0
- stoatchat revolt-january <= v0.13.7
Timeline
- 2026-07-13: advisory: GHSA-4mcc-p83c-r77q published
- 2026-07-15: patched: Version 0.14.0 released
- 2026-07-16: disclosed: CVE-2026-63088 published to NVD
References
- https://github.com/stoatchat/stoatchat/releases/tag/v0.14.0
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-4mcc-p83c-r77q
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5
- https://www.vulncheck.com/advisories/stoatchat-ssrf-via-dns-based-ip-blocklist-bypass