Executive brief
Wallos is an open-source subscription tracker that searches for payment logos via HTTP requests. An unauthenticated attacker can manipulate environment variables on the server hosting Wallos to force logo searches through a malicious proxy, enabling them to intercept internal network traffic, access sensitive data, or attack systems that are only reachable from within the company's network. This is a critical flaw in the trust boundary between the application and its runtime environment.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) flaw in the unauthenticated endpoint endpoints/payments/search.php. The endpoint performs HTTP requests using cURL and directly passes the HTTP_PROXY and HTTPS_PROXY environment variables to the CURLOPT_PROXY option without validation or hardening. Unlike the previously patched endpoint endpoints/logos/search.php, this second endpoint was not hardened against proxy-based SSRF attacks. An attacker with control over the server environment (or able to set environment variables through deployment misconfiguration or container escape) can direct all HTTP requests from this endpoint through a proxy server they control, enabling interception of requests and potential access to internal services.
Affected products
- Wallos Wallos prior to 5.0.0
Timeline
- 2026-08-31: disclosed
- 2026-07-11: patched: Fixed in version 5.0.0