Executive brief
Ech0 is a monitoring and alerting system that processes webhooks to notify administrators of application events. The webhook URL validation function fails to properly check hostnames that resolve to internal or cloud metadata IP addresses, allowing authenticated admins to create webhooks targeting internal services and steal sensitive data like cloud credentials. This undermines the application's intended security boundary and enables reconnaissance of internal network infrastructure.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the validateWebhookURL function (webhook_setting_service.go:180-199) caused by incomplete IP address validation. The function uses net.ParseIP() to detect private IPs, but this only matches literal IP strings and returns nil for hostnames. Attackers with admin privileges can craft URLs like "http://169.254.169.254.nip.io/latest/meta-data/" that pass validation yet resolve to private addresses. Once stored, active webhooks automatically fire on every application event via Dispatcher.HandleObservation without re-validation, enabling persistent outbound requests to internal services, cloud metadata endpoints (AWS, GCP, Azure), and internal network resources. The fix requires implementing a custom DNS-resolving dialer that validates resolved IPs before connection. Patched in version 4.4.3.
Affected products
- Ech0 Ech0 before 4.4.3
Timeline
- 2026-04-09: disclosed: GitHub security advisory published
- 2026-08-25: advisory: NVD and public vulnerability disclosure
- 2026-04-09: patched: Fix available in version 4.4.3