GHSA-vwq2-jx9q-9h9f

Source

https://github.com/advisories/GHSA-vwq2-jx9q-9h9f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-vwq2-jx9q-9h9f/GHSA-vwq2-jx9q-9h9f.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-vwq2-jx9q-9h9f

Aliases

CVE-2025-64522

Published

2025-11-10T21:34:44Z

Modified

2025-11-10T22:10:17Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L CVSS Calculator

Summary

Soft Serve is vulnerable to SSRF through its Webhooks

Details

SUMMARY

We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints.

AFFECTED COMPONENTS (VERIFIED)

Webhook Creation (pkg/ssh/cmd/webhooks.go:125)
Backend CreateWebhook (pkg/backend/webhooks.go:17)
Backend UpdateWebhook (pkg/backend/webhooks.go:122)
Webhook Delivery (pkg/webhook/webhook.go:97)

IMPACT

This vulnerability allows repository administrators to perform SSRF attacks, potentially enabling:

a) Cloud Metadata Theft - Access AWS/Azure/GCP credentials via 169.254.169.254 b) Internal Network Access - Target localhost and private networks (10.x, 192.168.x, 172.16.x) c) Port Scanning - Enumerate internal services via response codes and timing d) Data Exfiltration - Full HTTP responses stored in webhook delivery logs e) Internal API Access - Call internal admin panels and Kubernetes endpoints

PROOF OF CONCEPT

Simple example demonstrating localhost access:

ssh localhost webhook create my-repo http://127.0.0.1:8080/internal \
    --events push --active

then push to trigger.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "github_reviewed_at": "2025-11-10T21:34:44Z",
    "github_reviewed": true,
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

Affected packages

Go / github.com/charmbracelet/soft-serve

Package

Name: github.com/charmbracelet/soft-serve; View open source insights on deps.dev
Purl: pkg:golang/github.com/charmbracelet/soft-serve

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.11.1