SSRF Vulnerability in Hyperledger FireFly Webhook Subscription Component

Hyperledger FireFly versions up to and including 1.4.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw located in the ValidateOptions function within internal/events/webhooks/webhooks.go. This component, responsible for handling Webhook Subscriptions, fails to properly validate the 'url' parameter provided during configuration or execution. An unauthenticated remote attacker can exploit this flaw by supplying a crafted URL to the webhook service, forcing the application to perform requests on behalf of the server. This can lead to unauthorized access to internal services, metadata endpoints, or external resources. Public exploit code is currently available, and the vendor has not provided a patch or formal response to the disclosure, making this a high-priority risk for organizations running Hyperledger FireFly instances.

Impact

Successful exploitation allows an attacker to bypass perimeter security to scan and interact with internal network resources, potentially leading to unauthorized data exfiltration or access to sensitive internal APIs. As the vulnerability is remote and requires no authentication, instances exposed to the internet are at immediate risk of exploitation.

Recommendation

Prioritize network-level segmentation to restrict the ability of the Hyperledger FireFly service to make outbound connections to internal and private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Monitor webserver logs for unexpected requests to internal infrastructure or unusual URL patterns targeting administrative interfaces. Ensure that the FireFly service runs with the least privilege necessary to minimize the impact if an SSRF condition is successfully triggered.