Executive Summary

CVE-2026-33401 is a Server-Side Request Forgery (SSRF) vulnerability in the Wallos application, an open-source personal subscription tracker. It is an incomplete fix of a prior SSRF issue where protections were only applied to notification test endpoints but missed three critical attack surfaces: the AI Ollama host parameter, the AI recommendations endpoint, and the notification cron job.

Authenticated users can supply crafted URLs to these unprotected endpoints, causing the server to make unauthorized internal network requests. These requests can target internal services, cloud metadata endpoints (such as AWS IMDSv1, GCP, Azure IMDS), or localhost-bound services without proper validation or SSRF protection.

• Unprotected endpoints include: endpoints/ai/fetch_models.php (ollama_host parameter), endpoints/ai/generate_recommendations.php (user-configured Ollama URL), and endpoints/cronjobs/sendnotifications.php (notification URLs stored in the database).
• The SSRF helper used does not block Carrier-Grade NAT IP ranges, allowing SSRF attacks in environments using CGNAT or Tailscale.

This vulnerability allows authenticated users to bypass SSRF protections and make server-side requests to internal or cloud metadata services, potentially exposing sensitive information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several serious impacts if exploited by an authenticated user:

• Attackers can probe internal network topology by sending requests to internal IP addresses and measuring response times.
• Attackers can access cloud instance metadata services (AWS, GCP, Azure), potentially retrieving sensitive IAM credentials, identity tokens, or other confidential data.
• Attackers can reach localhost-bound services such as databases, admin panels, or internal APIs that are not exposed externally, potentially leading to further compromise.

Overall, this SSRF vulnerability can lead to unauthorized internal network access, data leakage, and increased risk of further exploitation within the affected environment.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring and testing the specific Wallos endpoints that are vulnerable to SSRF attacks. Authenticated users can send crafted requests to the following endpoints to check if SSRF protections are missing:'}, {'type': 'list_item', 'content': "POST requests to endpoints/ai/fetch_models.php with a user-controlled 'ollama_host' parameter set to internal IP addresses or cloud metadata endpoints (e.g., 169.254.169.254 for AWS IMDS)."}, {'type': 'list_item', 'content': 'Saving a malicious Ollama URL via endpoints/ai/save_settings.php and then triggering endpoints/ai/generate_recommendations.php to see if the server makes SSRF requests.'}, {'type': 'list_item', 'content': 'Saving malicious notification URLs (Gotify, Discord, Mattermost, ntfy, webhook URLs) via the relevant save endpoints and observing if the notification cron job (endpoints/cronjobs/sendnotifications.php) makes requests to these URLs without validation.'}, {'type': 'paragraph', 'content': 'Network detection can also involve monitoring outgoing HTTP requests from the Wallos server to internal IP ranges (including RFC1918 and Carrier-Grade NAT 100.64.0.0/10) or cloud metadata IPs. Timing connection attempts or unexpected requests to localhost or internal services can indicate exploitation attempts.'}, {'type': 'paragraph', 'content': 'Suggested commands for testing include using curl or similar tools to simulate the POST requests with crafted parameters, for example:'}, {'type': 'list_item', 'content': "curl -X POST -d 'ollama_host=http://169.254.169.254' https://your-wallos-instance/endpoints/ai/fetch_models.php"}, {'type': 'list_item', 'content': "curl -X POST -d 'url=http://malicious.internal' https://your-wallos-instance/endpoints/ai/save_settings.php"}, {'type': 'list_item', 'content': 'Observe logs or network traffic for outgoing requests to internal or cloud metadata IPs triggered by these actions.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Upgrade Wallos to version 4.7.0 or later, where this vulnerability has been patched.
• If upgrading is not immediately possible, restrict access to the vulnerable endpoints (endpoints/ai/fetch_models.php, endpoints/ai/generate_recommendations.php, endpoints/cronjobs/sendnotifications.php) to trusted users only.
• Manually review and sanitize any user-configurable URLs stored in the application, especially those related to AI Ollama host parameters and notification URLs.
• Implement network-level controls to block outgoing requests from the Wallos server to internal IP ranges (RFC1918 and Carrier-Grade NAT 100.64.0.0/10) and cloud metadata IP addresses (e.g., 169.254.169.254).
• Monitor logs and network traffic for suspicious outgoing requests that may indicate exploitation attempts.

Useful 0 Not Useful 0