A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL.

django: Django: Remote code execution via GeoDjango spatial lookups aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens tmp: path Traversal via unsanitized prefix/postfix enables directory escape awxkit: path traversal via YAML !include directive pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Arbitrary Code Execution via Joined Short Options Bypass gitpython: GitPython: Command Injection via Git option prefix abbreviation aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses awx: project archive extraction allows path traversal file writes awx: webhook status callback SSRF leaks the Git PAT awx: notification backends allow SSRF and credential leakage gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding GitPython: GitPython: Arbitrary file read via TagReference.create()