Executive brief
Hi.Events is an open-source event management platform that allows administrators to configure webhooks to external systems. The platform validates webhook URLs only when they are initially registered, but not when webhooks are actually dispatched. This enables attackers to register a webhook pointing to an attacker-controlled domain, then change that domain's DNS records to redirect to internal systems (like cloud metadata endpoints or private servers), causing Hi.Events to leak sensitive internal data. The platform does not validate redirects, allowing a single HTTP redirect to reach internal systems.
Technical details
This is a server-side request forgery (SSRF) vulnerability resulting from time-of-check-time-of-use (TOCTOU) logic in webhook validation. The NoInternalUrlRule validator in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname at registration time using gethostbyname(), checking that the resolved IP is not in private/reserved ranges; however, this validation is never repeated when webhooks are dispatched. Additionally, the Guzzle HTTP client is configured with redirect following enabled by default (no options override in backend/config/webhook-server.php), and the WebhookDispatchService does not validate redirect destinations. An attacker can register a webhook with a public domain, then change that domain's DNS record to resolve to a private/cloud metadata address (e.g., 169.254.169.254), or use a single HTTP redirect to the same target. The response body is stored in the webhook log and returned via the WebhookLogResource endpoint, allowing the attacker to read internal service responses (such as cloud provider credentials). Version 1.11.1-beta resolves this by revalidating the URL at dispatch time, pinning the validated address, checking every redirect hop, and handling IPv6 transition addresses.
Affected products
- HiEvents Hi.Events before 1.11.1-beta
Timeline
- 2026-08-24: disclosed
- 2026: patched: Version 1.11.1-beta includes revalidation at dispatch and full validation of redirect chains