Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

### Summary The SNS `UnsubscribeConfirmation` handler in `internal/integrations/ingestors/sns/sns.go` makes an unvalidated `http.Get()` call to `payload.UnsubscribeURL` without any URL restriction. Because `UnsubscribeURL` is intentionally excluded from the `BuildSignature()` signed field list, an attacker can replace this field in a legitimately AWS-signed message with an arbitrary internal URL, bypassing the `VerifyPayload()` signature check entirely and triggering a Server-Side Request Forgery (SSRF) against internal infrastructure — including the EC2 Instance Metadata Service (IMDS) at `169.254.169.254`. ### Impact This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker with a Hatchet account and an AWS Free Tier account can: - Reach the EC2 IMDS endpoint and retrieve IAM temporary credentials if Hatchet is deployed on AWS - Port-scan and probe internal services not exposed to the internet - Access internal HTTP APIs (e.g., Kubernetes API server, internal dashboards) from the Hatchet server's network context

Source published

22 Sep 2026 20:34:12 UTC

Source modified

4 Nov 2026 23:45:05 UTC

Observed here

4 Nov 2026 23:56:21 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Publisher rating · MODERATE