GHSA-89v5-38xr-9m4j Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader

• npm postiz: <= 2.0.12 (no fix yet)

Summary Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection. Vulnerable Code 1. Webhook Send Endpoint (Most Critical) `apps/backend/src/api/routes/webhooks.controller.ts` lines 58-70: ```typescript async sendWebhook(@Body() body: any, @Query('url') url: string) { try { await fetch(url, { // No URL validation method: 'POST', body: JSON.stringify(body), headers: { 'Content-Type': 'application/json' }, }); } catch (err) { } return { send: true }; } ``` Accepts arbitrary URL via query parameter and fetches directly. 2. Stored Webhook Delivery `apps/orchestrator/src/activities/post.activity.ts` lines 256-281: ```typescript async sendWebhooks(postId: string, orgId: string, integrationId: string) { const webhooks = await this._webhookService.getWebhooks(orgId); return Promise.all( webhooks.map(async (webhook) => { await fetch(webhook.url, { // Stored URL, no validation method: 'POST', body: JSON.stringify(post), }); }) ); } ``` 3. RSS/XML Feed Parser `libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 135: ```typescript async loadXML(url: string) { const { items } = await parser.parseURL(url); // No URL validation } ``` 4. HTML Content Loader `libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 185: ```typescript async loadUrl(url: string) { const loadDom = new JSDOM(await (await fetch(url)).text()); // No validation } ``` Missing Protections • No `request-filtering-agent` or SSRF library • No private IP range filtering • No cloud metadata endpoint blocking • No DNS rebinding protection • URL validation only via `@IsUrl()` decorator (format only, no IP check) Attack Scenarios 1. `POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/` → AWS metadata theft 2. `POST /autopost/send?url=http://127.0.0.1:6379` → Internal Redis access 3. Create webhook with `http://10.0.0.1:8080/admin` → Internal service access on post publish Impact • Cloud metadata theft: AWS/GCP/Azure credentials • Internal network scanning: Full access to private IP ranges • Multiple entry points: Webhooks, RSS feeds, URL loader all vulnerable