Executive brief
OneUptime is an open-source monitoring and observability platform. The platform's webhook feature includes security checks to prevent Server-Side Request Forgery (SSRF) attacks by blocking requests to private and loopback addresses. However, a flaw in the validation logic fails to recognize IPv4-mapped IPv6 address formats (like [::ffff:127.0.0.1]), allowing an authenticated project member to bypass these restrictions and direct the server to private networks, loopback services, or metadata endpoints—with responses stored in readable webhook logs.
Technical details
The vulnerability is an SSRF bypass in OneUptime's SSRFProtection.validateWebhookTargetIsSafe function, specifically in the isBlockedHostnameLiteral check within Common/Server/Utils/SSRFProtection.ts. The vulnerable component correctly rejects private and loopback IPv4 ranges and several IPv6 forms (unspecified, loopback, link-local, unique-local), but fails to detect the IPv4-mapped IPv6 range (::ffff:0:0/96). An attacker can supply an address like [::ffff:127.0.0.1] which passes the literal-address check (not re-validated via DNS resolution) and is then interpreted by the HTTP client as its embedded IPv4 address (127.0.0.1). Exploitation requires authentication and webhook configuration privileges. Version 12.0.7 patches the issue by adding validation for the mapped range.
Affected products
- OneUptime OneUptime before 12.0.7
Timeline
- 2026-08-26: disclosed
- 2026: patched: Version 12.0.7 adds handling for IPv4-mapped IPv6 range