Executive brief
WACRM, a self-hostable customer relationship management (CRM) tool for WhatsApp, contains a security flaw in its automation system. An authorized user can configure the system to send automated webhooks to internal network addresses that should normally be inaccessible. This could allow an attacker to probe internal services or access sensitive cloud metadata, potentially leading to further compromise of the hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in WACRM versions 0.7.0 and earlier within the automation engine. The 'send_webhook' action in 'src/lib/automations/engine.ts' and its associated validation logic in 'src/lib/automations/validate.ts' fail to implement the 'isDeliverableUrl' guard used elsewhere in the application. An authenticated user with automation privileges can submit a crafted webhook URL pointing to loopback, link-local (such as 169.254.169.254), or private network addresses. The server will then execute a POST request to these addresses, potentially exposing internal service status codes or cloud metadata. The issue is resolved in commit 23838a9959550e975d732ae08a44a3a2f0cc084b by enforcing the SSRF guard and restricting redirects.
Affected products
- ArnasDon WACRM <= 0.7.0
Timeline
- 2026-07-08: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE published to NVD
- 2026-07-30: patched: Fix merged via commit 23838a9