Executive brief
Novu's notification workflow engine contains a server-side request forgery (SSRF) vulnerability in its conditions filter webhook feature. The vulnerability allows attackers who can configure workflow conditions to make the Novu worker process send HTTP POST requests to arbitrary internal services and cloud metadata endpoints (like AWS IMDSv1). The response data from these requests is stored and accessible via the API, enabling credential theft and reconnaissance of internal infrastructure.
Technical details
The vulnerability exists in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts at line 261, where user-supplied webhook URLs are passed directly to axios.post() without any SSRF validation. The codebase contains a validateUrlSsrf() function used elsewhere (in execute-http-request-step.usecase.ts) that blocks requests to private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16), but this protection was not applied to the conditions webhook path. An attacker with the ability to create or modify workflow conditions can configure a malicious webhook URL pointing to cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) or internal services. When the workflow is triggered, the worker evaluates the condition and makes the unvalidated POST request, with response data stored in execution details and exposed via the GET /execution-details API. While AWS IMDSv2 requires GET and credentials in headers, AWS IMDSv1 accepts POST and returns credentials in the response body. The attack requires workflow configuration access but succeeds even if the attacker cannot directly trigger the workflow.
Affected products
- Novu @novu/api <3.15.0
- Novu @novu/worker <3.15.0
Timeline
- 2026-04-14: disclosed: GHSA-4x48-cgf9-q33f published
- 2026-03-25: patched: Fix committed; patched in version 3.15.0