Security: SafeWebhookUrl DNS rebinding vulnerability

[Snider]

Description

The SafeWebhookUrl validation rule resolves DNS at validation time, but the actual HTTP request happens later. This creates a Time-Of-Check-Time-Of-Use (TOCTOU) vulnerability where an attacker could use DNS rebinding to bypass SSRF protections.

Location

src/Core/Rules/SafeWebhookUrl.php:196-227

Attack Scenario

1. Attacker sets up a malicious domain with a short TTL
2. First DNS lookup returns a public IP (passes validation)
3. TTL expires, second lookup returns 127.0.0.1 or internal IP
4. Webhook request goes to internal service

Recommended Fixes

1. Re-resolve and validate DNS immediately before making the HTTP request (not just at validation time)
2. Pin the resolved IP and use it directly for the connection
3. Use a custom HTTP client that validates resolved IPs before connecting
4. Consider implementing a pinned DNS resolver or using the IP directly

Additional Mitigations

• Block requests with very short TTLs
• Implement a webhook proxy service that performs validation at request time
• Use network-level controls (firewall rules) as defense in depth

Severity

Medium - Requires attacker to control a domain with short TTL DNS, but could lead to SSRF attacks against internal services.

[Snider]

Parent: #104