A customer pointed your webhooks at your own private network

transcript

A customer registers a webhook URL. Looks like any other. It points inside your own private network. At an admin page.

For every event, a worker posts to the URL the customer registered. And your workers run inside your infrastructure. Private addresses are reachable. So anyone can aim your servers at your private network. Your system becomes a proxy for attacks. That's SSRF.

So validate every URL before you register it. HTTPS only. Then resolve the hostname. If it won't resolve, reject it. Does it resolve to a private IP, like 10 dot anything? Rejected. Localhost and internal hostnames? Rejected too.

Then send a signed test event, to prove the endpoint really works. And publish your source IPs, so careful receivers can allow-list you.

A webhook URL is user input. And your server follows it. So check where it points at registration, before you ever send.

Full breakdown in the lecture.