De3Erve

An unrestricted Server-Side Request Forgery (SSRF) allows authenticated users to force the server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints, such as the AWS Instance Metadata Service (IMDS) at 169.254.169.254. When the `Setting::UserSignup` feature is enabled, low-privileged registered users can exploit this to scan internal services or steal cloud Identity and Access Management (IAM) credentials.

An unauthenticated Regular Expression Denial of Service (ReDoS) exists in the public Shop GraphQL API. The issue occurs when the `StringOperators.regex` filter is used, as the raw pattern is passed to a synchronous SQLite user-defined function (UDF) that executes within the Node.js event loop. An attacker can provide a catastrophically backtracking pattern—such as one containing nested quantifiers—to block the event loop, making the storefront and admin API unavailable. This specifically affects deployments using the `better-sqlite3` or `sqljs` database drivers. The `ShopProductsResolver.products` resolver is publicly accessible, allowing this attack to be triggered without authentication. PostgreSQL, MySQL, and MariaDB deployments are not affected as they do not execute this regular expression in the Node.js event loop.

An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks.

A broken access control issue exists in the `RemoveDependency` function within `routers/web/repo/issue dependency.go`. The function processes the `removeDependencyID` form parameter to identify and remove an issue dependency using `issues model.GetIssueByID(ctx, depID)` without performing necessary repository or permission checks. This allows an attacker with write access to issues in one repository to remove a dependency link to an issue in a different private repository and inject a comment into that private repository, even if they lack read access to it. This is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization.

The team-repository linking endpoint bypasses the `RepoAdminChangeTeamAccess` organization setting, which is intended to control whether repository administrators can change team access.