CVE-2026-27600: Homebox Information Disclosure Flaw

CVE-2026-27600 Overview

CVE-2026-27600 is a Server-Side Request Forgery (SSRF) vulnerability affecting HomeBox, a home inventory and organization system developed by sysadminsmedia. The vulnerability exists in the notifier functionality, which allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port, enabling attackers to probe internal network services and infrastructure.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to enumerate internal services and discover network infrastructure through behavioral side-channels, potentially mapping internal systems for further attacks.

Affected Products

• sysadminsmedia HomeBox versions prior to 0.24.0-rc.1

Discovery Timeline

• 2026-03-03 - CVE-2026-27600 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27600

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The notifier functionality in HomeBox allows authenticated users to configure notification endpoints by specifying arbitrary URLs. The application then sends HTTP POST requests to these user-supplied destinations without properly validating or restricting the target host, IP address, or port.

While the application does not return the response body from the target service to the user, the UI behavior differs depending on the network state of the destination. This behavioral difference creates a side-channel that attackers can exploit to enumerate internal services. By observing response timing, error messages, or UI state changes, an attacker can determine whether internal hosts and ports are accessible, effectively mapping the internal network topology.

Root Cause

The root cause of this vulnerability is the lack of input validation on user-supplied URLs in the notifier configuration. The application accepts arbitrary URLs without implementing essential security controls such as URL scheme whitelisting, IP address range blocking (to prevent access to internal/private IP ranges), or port restrictions. This allows authenticated users to direct the server to make requests to any network destination, including internal services that should not be accessible.

Attack Vector

The attack vector is network-based and requires low-privilege authenticated access to the HomeBox application. An attacker would:

1. Authenticate to the HomeBox application with valid credentials
2. Access the notifier configuration functionality
3. Supply URLs targeting internal IP addresses (e.g., http://192.168.1.1:8080/, http://10.0.0.5:3306/)
4. Observe the application's UI behavior to determine which internal services are reachable
5. Systematically enumerate ports and hosts to map the internal network infrastructure

The vulnerability manifests in the notifier URL handling logic where user-supplied URLs are processed without validation. Attackers can supply internal IP addresses or hostnames, and the application's behavioral response reveals connectivity information about internal services. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-27600

Indicators of Compromise

• Unusual notifier configuration entries containing internal IP addresses (RFC 1918 ranges: 10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• High volume of notifier configuration changes by a single user
• Notifier URLs targeting uncommon ports or internal service endpoints
• Failed or delayed HTTP requests originating from the HomeBox server to internal infrastructure

Detection Strategies

• Monitor application logs for notifier configuration changes containing private IP ranges
• Implement network-level detection for outbound HTTP requests from the HomeBox server to internal RFC 1918 addresses
• Alert on rapid successive notifier configuration modifications indicative of port scanning behavior
• Review audit logs for unusual patterns of notification endpoint testing

Monitoring Recommendations

• Enable verbose logging for the notifier functionality to capture all URL configuration attempts
• Deploy network intrusion detection rules to identify SSRF patterns from the HomeBox server
• Implement User and Entity Behavior Analytics (UEBA) to detect anomalous notifier configuration activity
• Regularly audit notifier configurations for unauthorized or suspicious endpoints

How to Mitigate CVE-2026-27600

Immediate Actions Required

• Upgrade HomeBox to version 0.24.0-rc.1 or later immediately
• Audit existing notifier configurations for any suspicious or internal URLs
• Review access logs for evidence of exploitation attempts
• Consider temporarily disabling the notifier functionality until patching is complete

Patch Information

The vulnerability has been addressed in HomeBox version 0.24.0-rc.1. Organizations should upgrade to this version or later to remediate the SSRF vulnerability. The fix implements proper URL validation and restrictions on the notifier functionality. For complete patch details, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level controls to restrict outbound HTTP requests from the HomeBox server to internal IP ranges
• Deploy a web application firewall (WAF) rule to block notifier requests targeting private IP addresses
• Limit access to the notifier configuration functionality to trusted administrators only
• Use network segmentation to isolate the HomeBox server from sensitive internal services

If upgrading is not immediately possible, consider implementing network egress filtering to prevent the HomeBox server from initiating connections to internal resources:

# Example iptables rules to block outbound connections to private IP ranges
# Apply to the server running HomeBox

# Block outbound to 10.0.0.0/8
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp -j DROP

# Block outbound to 172.16.0.0/12
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -j DROP

# Block outbound to 192.168.0.0/16
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -j DROP

# Block localhost connections from the application
iptables -A OUTPUT -d 127.0.0.0/8 -p tcp -j DROP