Executive brief
## Summary
Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection.
## Vulnerable Code
### 1. Webhook Send Endpoint (Most Critical)
**`apps/backend/src/api/routes/webhooks.controller.ts` lines 58-70:** ```typescript async sendWebhook(@Body() body: any, @Query('url') url: string) { try { await fetch(url, { // No URL validation method: 'POST', body: JSON.stringify(body), headers: { 'Content-Type': 'application/json' }, }); } catch (err) { } return { send: true }; } ```
Accepts arbitrary URL via query parameter and fetches directly.
### 2. Stored Webhook Delivery
**`apps/orchestrator/src/activities/post.activity.ts` lines 256-281:** ```typescript async sendWebhooks(postId: string, orgId: string, integrationId: string) { const webhooks = await this._webhookService.getWebhooks(orgId); return Promise.all( webhooks.map(async (webhook) => { await fetch(webhook.url, { // Stored URL, no validation method: 'POST', body: JSON.stringify(post), }); }) ); } ```
### 3. RSS/XML Feed Parser
**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 135:** ```typescript async loadXML(url: string) { const { items } = await parser.parseURL(url); // No URL validation } ```
### 4. HTML Content Loader
**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 185:** ```typescript async loadUrl(url: string) { const loadDom = new JSDOM(await (await fetch(url)).text()); // No validation } ```
## Missing Protections
- No `request-filtering-agent` or SSRF library - No private IP range filtering - No cloud metadata endpoint blocking - No DNS rebinding protection - URL validation only via `@IsUrl()` decorator (format only, no IP check)
## Attack Scenarios
1. `POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/` → AWS metadata theft 2. `POST /autopost/send?url=http://127.0.0.1:6379` → Internal Redis access 3. Create webhook with `http://10.0.0.1:8080/admin` → Internal service access on post publish
## Impact
- **Cloud metadata theft**: AWS/GCP/Azure credentials - **Internal network scanning**: Full access to private IP ranges - **Multiple entry points**: Webhooks, RSS feeds, URL loader all vulnerable