{"id":"CVE-2026-35036","revision":null,"records":[{"revision":"c707ba2102054dd891316ad274f6a762","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-35036","aliases":[],"title":"Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature","description":"Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.","state":0,"publishedAt":"2026-04-06T16:55:47.544+00:00","modifiedAt":"2026-04-07T14:09:40.939+00:00","affected":[{"ecosystem":"Vendor product","name":"Ech0","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lin-snow\",\n                    \"product\": \"Ech0\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.2.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-35036","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-35036","identifiers":["CVE-2026-35036"]},"retained":false,"historicalAffected":[]},{"revision":"fa9d4954e1fb494184f7ed8c10406bf4","observedAt":"2026-10-25T08:17:35.884+00:00","statement":{"source":"nvd","id":"CVE-2026-35036","aliases":[],"title":"Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the imple…","description":"Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8.","state":0,"publishedAt":"2026-04-06T17:17:12.94+00:00","modifiedAt":"2026-10-24T13:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35036","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-918"],"productCriteria":["cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-06T17:17:12.940","lastModified":"2026-10-24T13:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-35036","identifiers":["CVE-2026-35036"]},"retained":false,"historicalAffected":[]},{"revision":"c3b83eab46ef4bbaa4d4e10fa9f1a3a5","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-wc4h-2348-jc3p","aliases":["CVE-2026-35036","GO-2026-5704"],"title":"Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature","description":"### Summary\n\nEch0 implements **link preview** (editor fetches a page title) through **`GET /api/website/title`**. That is **legitimate product behavior**, but the implementation is **unsafe**: the route is **unauthenticated**, accepts a **fully attacker-controlled URL**, performs a **server-side GET**, reads the **entire response body** into memory (`io.ReadAll`). There is **no** host allowlist, **no** SSRF filter, and **`InsecureSkipVerify: true`** on the outbound client.\n\n**Attacker outcome :** Anyone who can reach the instance can **force the Ech0 server** to open **HTTP/HTTPS URLs of their choice** as seen from the **server’s network position** (Docker bridge, VPC, localhost from the process view). \nGo’s default `http.Client` **follows redirects** (unless disabled). Redirect chains can move the server-side request from an allowed-looking host to an internal target; the code does not disable this in `SendRequest`.\n\n### Affected Components\n\n**Ech0 codebase:**\n\n- `internal/handler/common/common.go`  \n  Handles the `/api/website/title` endpoint and accepts user-controlled URL input.\n\n- `internal/service/common/common.go`  \n  Processes the request and invokes the outbound HTTP fetch (`GetWebsiteTitle`).\n\n- `internal/util/http/http.go`  \n  Performs the HTTP request (`SendRequest`) with the following insecure configurations:\n  - No URL validation or allowlist\n  - Redirects enabled (default client behavior)\n  - `InsecureSkipVerify: true`\n\n### PoC \n\n**Environment:** Ech0 listening on `http://127.0.0.1:6277` (e.g. Docker image `sn0wl1n/ech0:latest`). No cookies or `Authorization` header.\n\n**Step 1 — baseline: unauthenticated server-side fetch (public URL):**\n\n```bash\ncurl.exe -sS -m 20 \"http://127.0.0.1:6277/api/website/title?website_url=https://example.com\"\n```\n\n**Observed result (verified):** HTTP 200, JSON with `code: 1` and `data` **`Example Domain`** — proves the **Ech0 process** performed an outbound GET without any client auth.\n\n**Step 2 — impact: host-bound page + recorded leak (repo PoC file)**\nCommitted PoC page: **`poc_ssrf_proof.html`** \n\n1. From **`poc file directory`**, listen on **0.0.0.0** (port **9999**):\n\n```bash\npython -m http.server 9999 --bind 0.0.0.0\n```\n\n2. **Docker Desktop (Windows / macOS):** Ech0 in Docker fetches the host via `host.docker.internal`:\n\n```bash\ncurl.exe -sS -m 20 \"http://127.0.0.1:6277/api/website/title?website_url=http://host.docker.internal:9999/poc_ssrf_proof.html\"\n```\n\n**Recorded response (verified this workspace, Ech0 4.2.2 in Docker):**\n\n```json\n{\"code\":1,\"msg\":\"获取网站标题成功\",\"data\":\"ECH0_SSRF_POC_LEAK_2026\"}\n```\n\n**Python server log:** `GET /poc_ssrf_proof.html` → **200** (proves the **server/container** pulled the page from your host).\n\n**Leak channel:** the backend **reads the full HTML body** before parsing (see `io.ReadAll` in `SendRequest`).\n\n\n### Impact\n\n- **Verified:** Unauthenticated callers can make the Ech0 process issue **server-side HTTP(S) requests** to **internal/reserved targets** reachable from that process (PoC Step 2: host-reachable listener reflected in JSON).\n- **Code-level:** The full response is **read into memory** (`io.ReadAll`); only the title string is returned. Combined with **default HTTP redirect following** (standard `http.Client` behavior; not disabled here), the effective request graph is larger than a single URL.\n- **TLS:** `InsecureSkipVerify: true` means **misissued or intercepted TLS** to internal HTTPS services is still accepted from the server’s perspective.\n- **Deployment-dependent:** Where routing allows (typical cloud VMs), **`169.254.169.254`-class** endpoints are in scope for the **same code path**; treat as **high*.\n- **DOS(Denial of Service)**: reading the whole body into memory with io.ReadAll is a DoS vector if you point it at a massive file.\n\n\n## Remediation\n\n- Enforce **SSRF-safe URL policy**: allow only needed schemes/hosts; block link-local, metadata, and loopback unless explicitly required.\n- Remove **`InsecureSkipVerify`**; use normal TLS verification.\n- **Limit redirects** (disable or cap hops; re-validate each target).\n- Add **response size / timeout** limits; optionally restrict egress at the **network** layer.","state":0,"publishedAt":"2026-04-03T03:30:53+00:00","modifiedAt":"2026-06-25T23:11:13.401133+00:00","affected":[{"ecosystem":"Go","name":"github.com/lin-snow/ech0","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.8-0.20260401031029-4ca56fea5ba4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p","https://nvd.nist.gov/vuln/detail/CVE-2026-35036","https://github.com/lin-snow/Ech0"],"sourceUrl":"https://github.com/advisories/GHSA-wc4h-2348-jc3p","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wc4h-2348-jc3p","identifiers":["GHSA-wc4h-2348-jc3p","CVE-2026-35036","GO-2026-5704"]},"retained":false,"historicalAffected":[]},{"revision":"3a20aa2b178249f4b8e263a837854eec","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5704","aliases":["CVE-2026-35036","GHSA-wc4h-2348-jc3p"],"title":"Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature in github.com/lin-snow/ech0","description":"Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature in github.com/lin-snow/ech0","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-06-25T23:01:40.0081655+00:00","affected":[{"ecosystem":"Go","name":"github.com/lin-snow/ech0","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.8-0.20260401031029-4ca56fea5ba4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p","https://nvd.nist.gov/vuln/detail/CVE-2026-35036"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5704","license":"OSV · upstream source license applies","key":"osv:GO-2026-5704","identifiers":["GO-2026-5704","CVE-2026-35036","GHSA-wc4h-2348-jc3p"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T02:37:01.8023049+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T02:37:01.8023049+00:00","lastSuccessAt":"2026-10-26T02:37:01.9582808+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.9582828+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-db718265d4164c5786f6ba29fb49aaca9f98d018ab1781237fdcf612cd6089e1","complete":true,"records":414057,"lastAttemptAt":"2026-10-26T02:35:18.1393313+00:00","lastSuccessAt":"2026-10-26T02:35:18.1285176+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:35:18.1393313+00:00","snapshotPublishedAt":"2026-10-26T01:45:24+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T02:37:04.5963782+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T02:37:01.8023049+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T02:37:01.8023049+00:00","lastSuccessAt":"2026-10-26T02:37:02.0734316+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:02.0734335+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T02:37:02.696128+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T02:37:01.7380852+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.7380852+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T02:35:18.2014911+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:35:18.2014911+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T02:37:01.7526933+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.7526933+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-d6410afbb1aa373ee2535dba99f1cc1a4b2a7a61e4171d3e4abf4e44fb758256","complete":true,"records":230794,"lastAttemptAt":"2026-10-26T02:37:01.5387917+00:00","lastSuccessAt":"2026-10-26T02:37:00.2862835+00:00","error":null,"lastVerifiedAt":"2026-10-26T02:37:01.5387917+00:00","snapshotPublishedAt":"2026-10-26T01:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}