The vulnerability in Firefly III's webhook URL validator (IsValidWebhookUrl.php) arises because it filters most private and reserved IPv4 ranges but explicitly allows any resolved address in the 127.0.0.0/8 loopback range due to an early return in the code. This permits an authenticated user with webhooks enabled (off by default) to configure webhooks targeting loopback services on the server. Additionally, the validator resolves the target hostname once at validation time using gethostbyname(), but the actual outbound webhook request (via StandardWebhookSender.php using Guzzle) independently re-resolves the hostname at send time. This discrepancy allows a DNS rebinding attacker to pass validation with a public IP but have the real request sent to a private or internal address. The webhook response body is only logged server-side and not returned to the user, making this a blind SSRF vulnerability (CWE-918).

An authenticated user with webhooks enabled can exploit this vulnerability to perform blind SSRF attacks targeting internal loopback services on the server. This could potentially allow interaction with internal services not normally accessible externally. However, the webhook response is only logged internally and not exposed to the user, limiting direct data exfiltration. The vulnerability does not affect confidentiality but can impact integrity by allowing unauthorized internal requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable webhooks if not needed (they are off by default). Avoid enabling webhooks for untrusted users. Monitor for updates from Firefly III regarding an official fix addressing the loopback IP validation and DNS rebinding issues.