GHSA-xf3p-2j7c-6hg4: MikroDash before 0.8.79 SSRF via Personal Notification Channels
MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
MikroDash versions before 0.8.79 are affected. The issue is reachable through personal notification channels.
What level of access does an attacker need?
Any signed-in user can exploit the issue, including a user assigned the viewer role. No user interaction is required.
What can an attacker target through the vulnerable functionality?
An attacker can configure webhook or mail destinations pointing to loopback, LAN, or link-local addresses, then invoke the notification-channel test endpoint to probe those internal addresses.