lin-snow Ech0 SSRF via DNS resolution bypass in webhooks

Executive brief

Ech0 is a Go-based application that supports webhooks for event notifications. A vulnerability allows administrators to bypass security filters and force the server to send requests to internal network services or cloud metadata endpoints. This could lead to the theft of sensitive cloud credentials or the mapping of private internal infrastructure.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `validateWebhookURL` function within `webhook_setting_service.go`. The validation logic uses `net.ParseIP()` to check for private or loopback addresses, but this function returns `nil` for hostnames, allowing DNS-based bypasses (e.g., using nip.io). Because the application's HTTP clients do not use a custom dialer to verify the resolved IP address, an attacker with administrative privileges can store a webhook that targets internal resources. This is particularly impactful in cloud environments where an attacker can access the instance metadata service (IMDS) to retrieve IAM credentials. The issue is fixed in version 4.4.3 by implementing a custom dialer that validates IPs after DNS resolution.

Affected products

• lin-snow Ech0 < 4.4.3

Timeline

• 2026-04-09: disclosed
• 2026-04-10: advisory
• 2026-04-10: patched

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D