SSRF in Automatisch via HTTP Request App

Executive Summary

This is a server-side request forgery (SSRF) vulnerability in Automatisch. A low-privileged authenticated user with 'manage Flow' permission can exploit it to make the server fetch arbitrary URLs and retrieve full response bodies via the HTTP Request app's Custom Request action. The vulnerability exists because the server passes user-supplied URLs directly to the HTTP client without any SSRF controls, allowing access to internal services and metadata endpoints.

Useful 0 Not Useful 0

Detection Guidance

Monitor HTTP request actions in Automatisch workflows for unusual outbound requests to internal or external URLs. Check logs for custom HTTP requests with unexpected destinations or large response bodies. Use network monitoring tools to detect unauthorized server-side requests originating from the application.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access internal services, retrieve sensitive data from metadata endpoints, or exfiltrate internal network information. This could lead to unauthorized data exposure, internal network reconnaissance, or further attacks on internal systems if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using Automatisch may face compliance breaches if internal data is exposed through this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the 'Custom Request' action in Automatisch workflows. Update to the latest version if a patch is available. Restrict 'manage Flow' permissions to trusted users only. Implement network-level controls to block unauthorized outbound requests from the application.

Useful 0 Not Useful 0