SSRF via Webhook Worker - PublicDomain validator is TLD-only, no delivery-time IP filter, response readable via GET /v1/webhooks/:id (CWE-918)

# SSRF via Webhook Worker — `PublicDomain` validator is TLD-only, no delivery-time IP filter, error-response body is readable via `GET /v1/webhooks/:id` **Project:** Appwrite **Commit reviewed:** `53a114e` (main) **Severity:** Medium / High (context-dependent — CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L — **8.2** when the target environment exposes sensitive internal HTTP services; lower when isolated) **CWE:** CWE-918 — Server-Side Request Forgery **Report By:** ProScan AppSec (https://proscan.one) **Date:** 2026-04-09 --- I was walking Appwrite's webhook plumbing to see whether the URL the worker actually hits could be steered outside `http(s)://public-domain/…`. The save-time validator on the `url` field in `POST /v1/webhooks` looked convincing at first glance — it's a `Multiple` composition of `URL(['http','https'])` and `PublicDomain`. The scheme-only check is fine on its own. The piece that surprised me is what `PublicDomain` actually does. ## The validator doesn't do what the name suggests **`src/Appwrite/Platform/Modules/Webhooks/Http/Webhooks/Create.php:64`** ```php ->param('url', '', fn () => new Multiple([new URL(['http', 'https']), new PublicDomain()], Multiple::TYPE_STRING), 'Webhook URL.') ``` `PublicDomain` comes from `utopia-php/domains` (`src/Domains/Validator/PublicDomain.php`). Its `isValid` routes through `Domain::isKnown()`, and `isKnown()` is: ```php public function isKnown(): bool { if (\array_key_exists($this->getRule(), self::$list)) { return true; } return false; } ``` That's a lookup against a public suffix list. It confirms the domain *has a known TLD*, nothing more. No `gethostbyname`, no `filter_var(..., FILTER_FLAG_NO_PRIV_RANGE)`, no IP range comparison — nothing about resolution. So any hostname under a recognized TLD passes: `169-254-169-254.nip.io`, `100-100-100-200.sslip.io`, `metadata.attacker.com`, or even a domain whose A record you control and flip to `127.0.0.1` after the webhook is saved. In other word…