Summary
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
The conditions filter webhook at libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts line 261 sends POST requests to user-configured URLs using raw axios.post() with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses validateUrlSsrf() which blocks private IP ranges. The conditions webhook was not included in this protection.
Root Cause
conditions-filter.usecase.ts line 261:
return await axios.post(child.webhookUrl, payload, config).then((response) => {
return response.data as Record<string, unknown>;
});
No call to validateUrlSsrf(). The webhookUrl comes from the workflow condition configuration with zero validation.
Protected Code (for contrast)
execute-http-request-step.usecase.ts line 130:
const ssrfValidationError = await validateUrlSsrf(url);
if (ssrfValidationError) {
// blocked
}
This function resolves DNS and checks against private ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16). It exists in the codebase but is not applied to the conditions webhook path.
Proof of Concept
- Create a workflow with a condition step
- Configure the condition's webhook URL to
http://169.254.169.254/latest/meta-data/iam/security-credentials/ - Trigger the workflow by sending a notification event
- The worker evaluates the condition and calls
axios.post()to the metadata endpoint - The response data is stored in execution details and accessible via the execution details API
Impact
Full-read SSRF. The response body is returned as Record<string, unknown> for condition evaluation and stored in the execution details raw field. The GET /execution-details API returns this data.
The POST method limits some metadata endpoints (GCP requires GET, Azure requires GET), but AWS IMDSv1 accepts POST and returns credentials. Internal services accepting POST are also reachable.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Extract validateUrlSsrf() to a shared utility and call it before the axios.post in conditions-filter.usecase.ts:
const ssrfError = await validateUrlSsrf(child.webhookUrl);
if (ssrfError) {
throw new Error('Webhook URL blocked by SSRF protection');
}
return await axios.post(child.webhookUrl, payload, config)...
Frequently Asked Questions
- What is GHSA-4X48-CGF9-Q33F? GHSA-4X48-CGF9-Q33F is a high-severity server-side request forgery (SSRF) vulnerability in @novu/api (npm), affecting versions < 3.15.0. It is fixed in 3.15.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
- Which versions of @novu/api are affected by GHSA-4X48-CGF9-Q33F? @novu/api (npm) versions < 3.15.0 is affected.
- Is there a fix for GHSA-4X48-CGF9-Q33F? Yes. GHSA-4X48-CGF9-Q33F is fixed in 3.15.0. Upgrade to this version or later.
- Is GHSA-4X48-CGF9-Q33F exploitable, and should I be worried? Whether GHSA-4X48-CGF9-Q33F is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-4X48-CGF9-Q33F is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-4X48-CGF9-Q33F? Upgrade
@novu/apito 3.15.0 or later.