Ech0 Unauthenticated Server-Side Request Forgery Vulnerability

The Ech0 application suffers from an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its website preview feature. The /api/website/title endpoint, intended to fetch website titles, accepts a fully attacker-controlled URL without authentication. This allows anyone who can reach the Ech0 instance to force the server to make HTTP/HTTPS requests to arbitrary URLs. The application lacks a host allowlist, SSRF filter, and disables TLS certificate validation (InsecureSkipVerify: true). The backend reads the full HTML body into memory, which combined with enabled HTTP redirect following and the insecure TLS setting, allows attackers to target internal services and potentially cause a denial of service. The vulnerability is present in Ech0 versions prior to 1.4.8-0.20260401031029-4ca56fea5ba4.

Attack Chain

1. An attacker identifies an Ech0 instance and the /api/website/title endpoint.
2. The attacker crafts a malicious URL targeting an internal resource or a service on the Ech0 server’s network.
3. The attacker sends an unauthenticated GET request to /api/website/title with the website_url parameter set to the malicious URL (e.g., http://127.0.0.1:6277/api/website/title?website_url=http://host.docker.internal:9999/poc_ssrf_proof.html).
4. The Ech0 server, lacking proper validation, makes an HTTP(S) request to the attacker-specified URL using internal/util/http/http.go.
5. If the targeted URL redirects, the Ech0 server follows the redirect due to the default http.Client behavior.
6. The Ech0 server reads the entire response body into memory using io.ReadAll, potentially leaking sensitive information or causing a denial of service if the response is large.
7. The Ech0 server parses the HTML body looking for the title and returns the title, or an error message, to the attacker.
8. The attacker gains access to information from internal services or causes a denial-of-service condition by exhausting server resources.

Impact

This SSRF vulnerability allows unauthenticated attackers to force the Ech0 server to make HTTP(S) requests to internal or reserved targets reachable from the server’s network. A successful attack can lead to information disclosure, such as leaking cloud metadata from 169.254.169.254-class endpoints, or access to internal services that are not exposed to the public internet. The io.ReadAll function makes the Ech0 server susceptible to denial-of-service attacks if the attacker provides a URL that returns a large response. The number of victims depends on the deployment of the Ech0 application and the accessibility of internal resources from the Ech0 server’s network.

Recommendation

• Deploy the Sigma rule Detect Ech0 SSRF via Website Title API to detect attempts to exploit this vulnerability by monitoring requests to the /api/website/title endpoint with suspicious URLs.
• Block access to internal metadata endpoints like 169.254.169.254 from the Ech0 server if not explicitly required, mitigating the risk of cloud metadata exposure.
• Apply the patch by upgrading to Ech0 version 1.4.8-0.20260401031029-4ca56fea5ba4 or later, addressing the underlying code flaws (CVE-2026-35036).