Security: SSRF risk in user-controlled service URLs #111

New Issue

2026-06-06T11:50:07Z

jmiller commented

2026-06-06 11:50:07 +00:00

Audit Finding

Severity: Medium

Issue:
WebhookService, MastodonService, GhostService, BlueskyService accept user-provided URLs in credentials and pass directly to curl_init() without validation. An admin could configure URLs targeting internal infrastructure (169.254.169.254, localhost).

Fix: Add URL validation to reject private/internal IP ranges. Set CURLOPT_PROTOCOLS to restrict to HTTP/HTTPS.

Files: WebhookService.php, MastodonService.php, GhostService.php, BlueskyService.php

## Audit Finding **Severity:** Medium **Issue:** WebhookService, MastodonService, GhostService, BlueskyService accept user-provided URLs in credentials and pass directly to `curl_init()` without validation. An admin could configure URLs targeting internal infrastructure (`169.254.169.254`, `localhost`). **Fix:** Add URL validation to reject private/internal IP ranges. Set `CURLOPT_PROTOCOLS` to restrict to HTTP/HTTPS. **Files:** `WebhookService.php`, `MastodonService.php`, `GhostService.php`, `BlueskyService.php`

jmiller commented

2026-06-06 11:50:10 +00:00

Branch created: feature/111-security-ssrf-risk-in-user-controlled-se

git fetch origin
git checkout feature/111-security-ssrf-risk-in-user-controlled-se

Branch created: [`feature/111-security-ssrf-risk-in-user-controlled-se`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomCross/src/branch/feature/111-security-ssrf-risk-in-user-controlled-se) ```bash git fetch origin git checkout feature/111-security-ssrf-risk-in-user-controlled-se ```

jmiller referenced this issue from a commit

2026-06-06 14:33:22 +00:00

security: fix 9 security and critical bugs (#107-#115, #120)

jmiller closed this issue

2026-06-06 14:35:09 +00:00

Sign in to join this conversation.

Type —

Status —

Priority —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCross#111