Threats tagged 'ghsa-4x48-cgf9-q33f'

A Server-Side Request Forgery (SSRF) vulnerability exists in the conditions filter webhook of the @novu/api package prior to version 3.15.0. The webhook sends POST requests to user-configured URLs without applying SSRF validation, allowing attackers to make unauthorized internal network requests. This flaw bypasses the validateUrlSsrf() protection that is correctly applied elsewhere in the codebase. Exploitation can lead to reading sensitive internal data, such as AWS instance metadata credentials, which are returned and exposed via the execution details API.