REDHAT-BUG-2506685: SSRF
A flaw was found in Red Hat Quay's notification webhook dispatch feature. The SlackMethod and WebhookMethod notification handlers in notifications/notificationmethod.py accept attacker-controlled URLs without applying the validateexternalregistryurl() SSRF validator that protects other Quay features (proxy cache, organization mirror, repository mirror). A repository administrator can create a notification whose delivery URL points to internal network addresses. When the notification fires, the Quay worker performs a POST request to the attacker-specified URL, enabling blind SSRF from the worker network context. The WebhookMethod includes a HOSTNAMEBLACKLIST check, but it only performs exact-hostname matching against a minimal default list (localhost, 127.0.0.1) and is trivially bypassed with private IP literals, cloud metadata hostnames, or DNS rebinding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify notifications/notificationmethod.py so that both SlackMethod and WebhookMethod handlers call validate_external_registry_url() before dispatching webhook delivery POST requests to any administrator-supplied delivery URL.
Red Hat Quay (notifications/notificationmethod.py) - SlackMethod and WebhookMethod URL validation for attacker-controlled delivery URLs = Use validate_external_registry_url() SSRF validator (the one used for proxy cache, organization mirror, repository mirror) for SlackMethod and WebhookMethod - Configuration
Update WebhookMethod to remove/augment the minimal HOSTNAME_BLACKLIST exact-hostname check so that delivery URLs cannot target private IP literals, cloud metadata hostnames, or be bypassed via DNS rebinding; enforce the same validate_external_registry_url() SSRF protection as other Quay features.
Red Hat Quay (notifications/notificationmethod.py) - WebhookMethod HOSTNAME_BLACKLIST check behavior = Do not rely on exact-hostname blacklist matching (e.g., localhost, 127.0.0.1) alone; enforce robust external URL validation against private IPs, cloud metadata hostnames, and DNS rebinding - Compensating control
Network-segment egress from the Quay worker/notification dispatch service so it cannot reach internal network addresses (including private IP ranges and cloud instance metadata endpoints) referenced by attacker-supplied notification delivery URLs.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2506685?
The severity of REDHAT-BUG-2506685 is categorized as medium.
How does REDHAT-BUG-2506685 affect Red Hat Quay?
REDHAT-BUG-2506685 affects Red Hat Quay by allowing attacker-controlled URLs to bypass validation in its notification webhook dispatch feature.
What type of vulnerability is REDHAT-BUG-2506685?
REDHAT-BUG-2506685 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
How can I fix REDHAT-BUG-2506685?
To fix REDHAT-BUG-2506685, update to the latest version of Red Hat Quay that addresses the flaw regarding the notification webhook dispatch feature.
What is the potential risk associated with REDHAT-BUG-2506685?
The potential risk associated with REDHAT-BUG-2506685 is that attackers could exploit the vulnerability to send malicious requests to internal services.