Postiz Security Advisories
All advisories
PSA-2026-04-M1S0CVE-2026-42346GCVE-125-2026-04-M1S0April 28, 2026
6.5 Medium

TOCTOU DNS rebinding bypasses all SSRF URL validation paths

TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 2.16.6, no known fixAffected

    All other versions: Unaffected

Mitigations

Solutions

  • Upgrade to vX.XX.XX or later.

Exploits

  • Full-read access to the internal network.

Overview

All SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses.

Severity

CVSS v3
6.5 Medium
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Weaknesses (1)

References (2)

Credits (3)

  • Junghwan
    Reporter · @shaun0927
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • Internal network scanning: An attacker can probe internal hosts and ports via timing differences in webhook delivery. Even though responses are not returned, reachability can be inferred.

  • Blind interaction with internal services: The SSRF sends POST requests with attacker-influenced body content (serialized post data) to internal services. Services without authentication (e.g., internal APIs, caches, message queues) could be manipulated.

  • Cloud metadata access: On cloud deployments (AWS, GCP, Azure), the instance metadata service at 169.254.169.254 may be reachable, potentially exposing IAM credentials or instance configuration. While the response is not reflected to the attacker, the POST request itself reaches the metadata service.

  • Persistence: The malicious webhook URL is stored in the database and triggered on every post publication until deleted, creating a persistent SSRF primitive.

Timeline

  1. 04/16/2026 03:12

    Postiz has received the report.

  2. 04/22/2026 15:29

    Postiz has developed the fix.

  3. 04/22/2026 16:00

    Postiz is awaiting a response from the reporter to test the fix developed by Postiz, as Postiz cannot fully reproduce / test the advisory due to the difficulty.