VALIDATED FINDING Evidence attached Server-Side Request Forgery in webhooks/receiver demo-project/sample-app · src/webhooks/receiver.py:42 SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorised target — the same control was validated to fail twice.
REVIEWER-READY REMEDIATION Merge-ready PR Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only. plexicus/remediation/webhooks-ssrf 3 changed · 0 new files 42resp = requests.get(target_url) 42+if not is_allowed_host(target_url): 43+ raise WebhookRejected(target_url) 44+resp = requests.get(target_url, timeout=5)