CVE-2025-64522: Soft Serve is vulnerable to SSRF through its Webhooks
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
Other sources
SUMMARY
We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints.
AFFECTED COMPONENTS (VERIFIED)
1. Webhook Creation (pkg/ssh/cmd/webhooks.go:125) 2. Backend CreateWebhook (pkg/backend/webhooks.go:17) 3. Backend UpdateWebhook (pkg/backend/webhooks.go:122) 4. Webhook Delivery (pkg/webhook/webhook.go:97)
IMPACT
This vulnerability allows repository administrators to perform SSRF attacks, potentially enabling:
a) Cloud Metadata Theft - Access AWS/Azure/GCP credentials via 169.254.169.254 b) Internal Network Access - Target localhost and private networks (10.x, 192.168.x, 172.16.x) c) Port Scanning - Enumerate internal services via response codes and timing d) Data Exfiltration - Full HTTP responses stored in webhook delivery logs e) Internal API Access - Call internal admin panels and Kubernetes endpoints
PROOF OF CONCEPT
Simple example demonstrating localhost access:
sh ssh localhost webhook create my-repo http://127.0.0.1:8080/internal \ --events push --active
then push to trigger.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64522?
CVE-2025-64522 has a high severity rating due to the potential for internal services and other sensitive endpoints to be targeted.
How do I fix CVE-2025-64522?
To fix CVE-2025-64522, update to the patched version 0.11.1 of the affected software.
What systems are affected by CVE-2025-64522?
CVE-2025-64522 affects versions up to 0.11.0 of the 'github.com/charmbracelet/soft-serve' package.
What type of vulnerability is CVE-2025-64522?
CVE-2025-64522 is an SSRF (Server-Side Request Forgery) vulnerability.
Can CVE-2025-64522 be exploited remotely?
Yes, CVE-2025-64522 can be exploited remotely by leveraging unvalidated webhook URLs.