A critical SSRF vulnerability in WGDashboard enables authenticated attackers to abuse webhook functionality to make unauthorized internal network requests.

This is a Server-Side Request Forgery (CWE-918) vulnerability. Although the description specifies authenticated attackers, the CVSS vector indicates network-level access, allowing an attacker to leverage the webhook feature to interact with internal services that are otherwise inaccessible from the external network.

The CVSS score of 9.8 reflects the high potential for internal network reconnaissance and potential lateral movement. By retrieving responses from internal services, an attacker could bypass network perimeters, leading to the compromise of sensitive internal data or administrative interfaces.

Immediate Action: Review the vendor advisory for patch availability. If no patch is available for your version, restrict access to the webhook functionality and the WGDashboard administrative interface to trusted internal networks only.

Proactive Monitoring: Inspect outbound traffic from the WGDashboard server for anomalies, specifically targeting requests to internal IP ranges or sensitive internal services.

Compensating Controls: Configure the WGDashboard server with strict egress filtering to prevent it from initiating connections to non-essential internal or external destinations.

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub.

Due to the critical severity and the existence of public proof-of-concept code, this vulnerability should be treated as a high-priority risk. Administrators must restrict access to the WGDashboard interface and monitor for any signs of internal network probing until a vendor-supplied patch is installed.