Hyperdx Webhook and ClickHouse Proxy SSRF Vulnerability Details and POC

Vulnerability Overview Server-Side Request Forgery (SSRF) vulnerabilities exist in the webhook testing and ClickHouse connection testing endpoints. These two authenticated endpoints allow callers to fully control the target URL, with no URL allowlisting or internal network blocking in place. Any team member can probe or interact with internal network services (including Docker containers, cloud metadata endpoints, and other internal APIs) by setting the target URL to an internal address. The ClickHouse proxy endpoint also returns the HTTP response body from internal targets to the caller, enabling blind reflective SSRF in error messages. Impact Scope Internal Service Probing: Team members can probe internal network services (other containers, sidecar services, and cloud provider metadata endpoints). Sensitive Information Leakage: The ClickHouse proxy endpoint additionally leaks parts of the HTTP response body, allowing attackers to extract meaningful information from internal services that return non-JSON responses. Cloud Provider Metadata Endpoints: AWS/GCP/Azure instance metadata endpoints (169.254.169.254) are reachable, potentially exposing IAM role credentials, SSH keys, and boot keys. Remediation External Labeling: External labels have been added. Security Fixes: - Block private IPs in webhooks. - Fix the response body leakage in the ClickHouse proxy endpoint error handling. POC Code Vulnerability A - Webhook SSRF Vulnerability B - ClickHouse Proxy SSRF Response Body Leakage Self-SSRF Probing the API Itself

Goal Reached Thanks to every supporter — we hit 100%!

Hyperdx Webhook and ClickHouse Proxy SSRF Vulnerability Details and POC

More from this source