Executive brief
Eclipse Ditto is a backend system that manages digital twins of IoT devices. When creating or updating a Thing or Feature, users can specify a URL pointing to a configuration model (ThingModel) for that device. The system fetches this configuration from the supplied URL without properly validating the host or following security best practices for redirects. An authenticated attacker with permission to create or modify Things can exploit this to probe and attack internal network services—including cloud metadata endpoints and Kubernetes APIs—and potentially extract sensitive information from responses.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the WoT (Web of Things) integration module of Eclipse Ditto. When a Thing or Feature definition contains an HTTP(S) URL, the Things service fetches the referenced ThingModel from that URL without validating the target host against any allow-list or blocking list. Additionally, HTTP redirects are followed recursively without re-validating the redirect target or enforcing a hop limit. Any authenticated API user with permission to create a Thing or with WRITE access to an existing Thing can supply a malicious URL in the definition field and cause the service to issue arbitrary HTTP GET requests from within the internal network. The differing HTTP response codes (421 for non-JSON responses vs. 400 for invalid JSON) can be used as an oracle to enumerate internal services. Secondary impact includes an uncontrolled-recursion denial-of-service vector through redirect loops. The vulnerability is exploitable by default in versions 3.0.0–3.9.6; versions 2.4.0–2.5.x contain the same code but require explicit operator configuration to enable. Patches are available in versions 3.9.7 and 3.8.13.
Affected products
- Eclipse Ditto 3.0.0 to 3.9.6 (default config); 2.4.0 to 2.5.x (opt-in)
Timeline
- 2026-09-01: disclosed
- 2026-09-02: patched: Versions 3.9.7 and 3.8.13 released