PSA-2026-04-M1S0CVE-2026-42346GCVE-125-2026-04-M1S0April 28, 2026TOCTOU DNS rebinding bypasses all SSRF URL validation paths
TOCTOU DNS rebinding bypasses all SSRF URL validation paths
Affected (1)
- gitroomhqpostiz-app
- ≥ 2.16.6, no known fixAffected
All other versions: Unaffected
Mitigations
Solutions
- Upgrade to vX.XX.XX or later.
Exploits
- Full-read access to the internal network.
Overview
All SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Weaknesses (1)
References (2)
Credits (3)
- JunghwanReporter · @shaun0927
- Enno GelhausCoordinator · @egelhaus
- Nevo DavidRemediation developer · @nevo-david
Context
Impacts
Internal network scanning: An attacker can probe internal hosts and ports via timing differences in webhook delivery. Even though responses are not returned, reachability can be inferred.
Blind interaction with internal services: The SSRF sends POST requests with attacker-influenced body content (serialized post data) to internal services. Services without authentication (e.g., internal APIs, caches, message queues) could be manipulated.
Cloud metadata access: On cloud deployments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 may be reachable, potentially exposing IAM credentials or instance configuration. While the response is not reflected to the attacker, the POST request itself reaches the metadata service.
Persistence: The malicious webhook URL is stored in the database and triggered on every post publication until deleted, creating a persistent SSRF primitive.
Timeline
- 04/16/2026 03:12
Postiz has received the report.
- 04/22/2026 15:29
Postiz has developed the fix.
- 04/22/2026 16:00
Postiz is awaiting a response from the reporter to test the fix developed by Postiz, as Postiz cannot fully reproduce / test the advisory due to the difficulty.