Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-33399 is a Server-Side Request Forgery (SSRF) vulnerability in Wallos, an open-source personal subscription tracker. Before version 4.7.0, the SSRF protections were incomplete because the validation function validate_webhook_url_for_ssrf() was only applied to test notification endpoints but not to the save notification endpoints. This allowed an authenticated user to save an internal or private IP address as a notification URL. When the system's cron job executed, it sent requests to these internal IPs without any SSRF validation, potentially allowing unauthorized internal network access."}, {'type': 'paragraph', 'content': 'The vulnerability was patched in version 4.7.0 by adding comprehensive SSRF protections across multiple endpoints, including validation of URL schemes, whitelist checks against private IP ranges, and controlled DNS resolution to prevent exploitation.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This SSRF vulnerability can allow an authenticated user to make the Wallos server send requests to internal or private IP addresses that are normally inaccessible from outside. This can lead to unauthorized access to internal network resources, potentially exposing sensitive data or enabling further attacks within the internal network.

Since the vulnerability allows bypassing network restrictions, it can be exploited to scan internal services, access internal APIs, or trigger actions on internal systems, which could compromise the confidentiality and security of the affected environment.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for notification URLs saved via the save* endpoints that point to internal or private IP addresses. Since the vulnerability allows an authenticated user to save internal/private IP addresses as notification URLs, checking the database entries for such URLs is a key detection method.'}, {'type': 'paragraph', 'content': 'Additionally, observing the cron job sendnotifications.php making HTTP requests to internal IP addresses or cloud metadata endpoints (e.g., 169.254.169.254) can indicate exploitation attempts.'}, {'type': 'paragraph', 'content': 'Suggested commands include querying the database for notification URLs that resolve to private IP ranges or internal addresses. For example, if the notification URLs are stored in a database table, you can run SQL queries to find URLs containing private IP ranges such as 10.x.x.x, 172.16.x.x - 172.31.x.x, or 192.168.x.x.'}, {'type': 'list_item', 'content': "SQL example: SELECT * FROM notification_urls WHERE url LIKE 'http://10.%' OR url LIKE 'http://192.168.%' OR url LIKE 'http://172.16.%' OR url LIKE 'http://172.17.%' OR url LIKE 'http://172.18.%' OR url LIKE 'http://172.19.%' OR url LIKE 'http://172.20.%' OR url LIKE 'http://172.21.%' OR url LIKE 'http://172.22.%' OR url LIKE 'http://172.23.%' OR url LIKE 'http://172.24.%' OR url LIKE 'http://172.25.%' OR url LIKE 'http://172.26.%' OR url LIKE 'http://172.27.%' OR url LIKE 'http://172.28.%' OR url LIKE 'http://172.29.%' OR url LIKE 'http://172.30.%' OR url LIKE 'http://172.31.%';"}, {'type': 'list_item', 'content': 'Network monitoring commands such as tcpdump or Wireshark can be used to detect outgoing HTTP requests from the cron job to internal IP addresses.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Wallos to version 4.7.0 or later, where the SSRF fix has been fully applied to all save* notification endpoints.

If upgrading is not immediately possible, apply the validate_webhook_url_for_ssrf() function to all save* notification endpoints to ensure URLs are validated against private IP ranges before being saved.

Additionally, implement SSRF validation during the execution of sendnotifications.php as a defense-in-depth measure to prevent requests to internal IP addresses.

Restrict access to the save* endpoints to trusted authenticated users only, and audit existing notification URLs for any internal or private IP addresses.

Consider temporarily disabling the cron job sendnotifications.php or manually reviewing and cleaning notification URLs until the patch or mitigation is applied.

Useful 0 Not Useful 0