[Backend] Webhook subscriptions accept any URL, enabling SSRF to internal services

[grantfox-oss]

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Why this matters

Webhook registration in src/controllers/indexerController.ts (lines 494-520) only validates that callbackUrl parses and uses http/https. There is no block on loopback, link-local (169.254.169.254), or RFC1918 ranges, so an authenticated caller can make the indexer POST to internal services or cloud metadata endpoints.

Acceptance criteria

• Reject callback URLs that resolve to loopback, link-local, RFC1918 or other reserved ranges at registration time
• Re-validate the resolved address at delivery time in webhookService to defend against DNS rebinding
• Add tests covering 127.0.0.1, 169.254.169.254 and a 10.x host being rejected
• Document the allowed/blocked URL policy

Files to touch

• src/controllers/indexerController.ts
• src/services/webhookService.ts

Out of scope

• Building an allowlist UI
• Outbound proxy infrastructure

[System625]

I am writing to express my interest in resolving the SSRF vulnerability in the webhook subscription system.

With a strong background in backend security and Node.js development, I will implement rigorous URL and IP validation within indexerController.ts and webhookService.ts. To eliminate the risk of SSRF and DNS rebinding attacks, I will integrate a secure IP resolution check that explicitly blocks loopback (127.0.0.1), link-local (169.254.169.254), RFC1918 private networks, and other reserved ranges at both registration and delivery time.

I will write comprehensive test suites to validate these defenses against malicious payloads and fully document the new URL policy. I am ready to secure this pipeline immediately.

[Amarjeet325]

Hi, maintainers 👋.
I’d like to work on this issue.
I’m a full-stack developer and smart contract expert; I have previously contributed to multiple open-source projects.

Could you please assign this issue to me?

[grantfox-oss]

🦊 GrantFox — @System625 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #3)
2. Your PR will be reviewed by the LabsCrypt maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@System625's PR #43 was approved and merged by @ogazboiz.

🏆 @System625: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (121 total points). Track your full progress on GrantFox.

👏 Great work, @System625! Keep contributing to LabsCrypt.