CVE-2026-33407: Wallosapp Wallos SSRF Vulnerability

CVE-2026-33407 Overview

CVE-2026-33407 is a Server-Side Request Forgery (SSRF) vulnerability affecting Wallos, an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the endpoints/logos/search.php endpoint accepts HTTP_PROXY and HTTPS_PROXY environment variables without proper validation, enabling attackers to hijack proxy configurations and force the server to make arbitrary outbound requests. Additionally, the server performs DNS resolution on user-supplied search terms, which can be manipulated by attackers to trigger requests to arbitrary domains.

Critical Impact

Unauthenticated attackers can exploit this SSRF vulnerability to access internal services, exfiltrate sensitive data from internal networks, or pivot to attack other systems accessible from the Wallos server.

Affected Products

• Wallos versions prior to 4.7.0
• wallosapp wallos (all vulnerable versions)
• Self-hosted Wallos deployments running unpatched versions

Discovery Timeline

• 2026-03-24 - CVE-2026-33407 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33407

Vulnerability Analysis

This SSRF vulnerability (CWE-918) exists in the logo search functionality of Wallos. The vulnerable endpoint at endpoints/logos/search.php improperly handles proxy environment variables and processes user-supplied input for DNS resolution without adequate validation. This design flaw allows attackers to manipulate the application's outbound HTTP requests, either by injecting malicious proxy configurations or by supplying crafted search terms that trigger DNS lookups and HTTP requests to attacker-controlled or internal infrastructure.

The vulnerability can be exploited remotely without authentication, as the affected endpoint does not require user credentials. Attackers can leverage this flaw to probe internal network resources, access cloud metadata services, or interact with internal APIs that should not be externally accessible.

Root Cause

The root cause of this vulnerability lies in the improper handling of proxy-related environment variables (HTTP_PROXY and HTTPS_PROXY) and the lack of input validation for user-supplied search terms. The application blindly trusts these environment variables and allows user input to influence DNS resolution and subsequent HTTP requests without enforcing an allowlist of permitted destinations or properly sanitizing the input.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Manipulating the HTTP_PROXY or HTTPS_PROXY environment variables to redirect outbound requests through an attacker-controlled proxy server
2. Supplying specially crafted search terms that cause the server to perform DNS lookups and HTTP requests to arbitrary internal or external domains
3. Chaining these techniques to access internal services, cloud metadata endpoints (such as AWS IMDSv1 at 169.254.169.254), or other resources not intended to be externally accessible

The vulnerability allows attackers to bypass network segmentation and firewall controls by using the Wallos server as a proxy to reach otherwise protected resources.

Detection Methods for CVE-2026-33407

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from the Wallos server to internal IP addresses or cloud metadata endpoints
• HTTP requests to 169.254.169.254 (AWS metadata service) or similar cloud provider metadata endpoints originating from the application
• Unexpected DNS queries for internal hostnames or suspicious external domains from the Wallos server
• Log entries in endpoints/logos/search.php showing abnormal or malicious search terms

Detection Strategies

• Monitor outbound network traffic from Wallos instances for requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16)
• Implement web application firewall (WAF) rules to detect and block SSRF attack patterns in the logo search endpoint
• Review application logs for unusual search queries containing IP addresses, internal hostnames, or URL-like patterns
• Deploy network segmentation monitoring to detect attempts to access internal services from the Wallos server

Monitoring Recommendations

• Enable verbose logging for the endpoints/logos/search.php endpoint and regularly audit log entries for suspicious activity
• Configure alerts for outbound connections from the Wallos server to non-standard ports or internal network segments
• Implement egress filtering and monitor for any violations or anomalies in outbound traffic patterns
• Use SentinelOne's network visibility capabilities to track unusual connection patterns from the affected application

How to Mitigate CVE-2026-33407

Immediate Actions Required

• Upgrade Wallos to version 4.7.0 or later immediately to remediate this vulnerability
• If immediate upgrade is not possible, restrict network access to the Wallos server and limit its ability to make outbound connections
• Implement network segmentation to isolate the Wallos server from sensitive internal resources
• Review and audit any systems that may have been accessed through SSRF exploitation

Patch Information

The vulnerability has been patched in Wallos version 4.7.0. The fix is available in commit e87387f0ebb540cd33e6dfda7181db9db650ecef. Administrators should upgrade to the patched version as soon as possible. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-hhjq-82f8-m6rc and the commit changes.

Workarounds

• Implement strict egress firewall rules to prevent the Wallos server from making outbound connections to internal networks or cloud metadata services
• Use a reverse proxy or WAF to filter and validate requests to the endpoints/logos/search.php endpoint
• Disable the logo search functionality if it is not required in your deployment
• Deploy network-level controls to block access to cloud metadata endpoints (169.254.169.254) from application servers

# Example iptables rules to block SSRF to internal networks and cloud metadata
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP