Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature
Date: 2026-04
Affected: go/github.com/lin-snow/ech0
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-35036
CWE: CWE-918
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

### Summary Ech0 implements **link preview** (editor fetches a page title) through **`GET /api/website/title`**. That is **legitimate product behavior**, but the implementation is **unsafe**: the route is **unauthenticated**, accepts a **fully attacker-controlled URL**, performs a **server-side GET**, reads the **entire response body** into memory (`io.ReadAll`). There is **no** host allowlist, **no** SSRF filter, and **`InsecureSkipVerify: true`** on the outbound client. **Attacker outcome :** Anyone who can reach the instance can **force the Ech0 server** to open **HTTP/HTTPS URLs of their choice** as seen from the **server’s network position** (Docker bridge, VPC, localhost from the process view). Go’s default `http.Client` **follows redirects** (unless disabled). Redirect chains can move the server-side request from an allowed-looking host to an internal target; the code does not disable this in `SendRequest`. ### Affected Components **Ech0 codebase:** - `internal/handler/common/common.go` Handles the `/api/website/title` endpoint and accepts user-controlled URL input. - `internal/service/common/common.go` Processes the request and invokes the outbound HTTP fetch (`GetWebsiteTitle`). - `internal/util/http/http.go` Performs the HTTP request (`SendRequest`) with the following insecure configurations: - No URL validation or allowlist - Redirects enabled (default client behavior) - `InsecureSkipVerify: true` ### PoC **Environment:** Ech0 listening


Mitigations:

Architectural layers (MAESTRO):