Description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| triggerdotdev | trigger.dev | < 4.5.2 | 4.5.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | trigger.dev | < 4.5.2 | 4.5.2 | GHSA-xxv7-2vv3-h682 |
References
- GitHub Issue #4172 issue-tracking
- https://github.com/triggerdotdev/trigger.dev product
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254 patch
- Trigger.dev v4.5.2 Release Notes release-notes
- GitHub Security Advisory (GHSA-xxv7-2vv3-h682) vendor-advisory
- VulnCheck Advisory: Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel third-party-advisory