Executive brief
Hyperledger Firefly is a blockchain messaging platform that uses webhooks to notify external systems of events. A vulnerability in the webhook subscription validation allows attackers to manipulate the webhook URL parameter, enabling server-side request forgery (SSRF) attacks. This permits remote attackers to make unauthorized network requests from the server, potentially accessing internal services or exfiltrating sensitive data.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in the ValidateOptions function of the webhook subscription component (internal/events/webhooks/webhooks.go) in Hyperledger Firefly. The function fails to properly validate the URL argument supplied during webhook configuration, allowing an attacker to inject arbitrary URLs. The attack requires network access to the Firefly API endpoint and the ability to create or modify webhook subscriptions, but does not require authentication confirmation from available sources. An attacker can craft a malicious webhook URL to make the Firefly server perform requests to internal IP ranges, private services, or external targets, potentially leading to data exposure or lateral movement within a network infrastructure.
Affected products
- Hyperledger Firefly up to 1.4.0
Timeline
- 2026-08-31: disclosed