An authenticated SSRF vulnerability in HomeBox allows remote attackers to access internal network resources and sensitive metadata by bypassing existing notifier URL security protections.

This is a Server-Side Request Forgery (CWE-918) vulnerability located in the notifier URL validation logic. An authenticated user can bypass SSRF protections by submitting specifically crafted IPv6 addresses that leverage NAT64 translation to reach internal IPv4 services or cloud metadata endpoints.

The ability to perform SSRF poses a significant risk to organizational confidentiality. An attacker who has obtained low-level authenticated access can potentially exfiltrate temporary credentials or sensitive internal configuration data, which could lead to further lateral movement within the network. While the CVSS score is 6.0, the potential for unauthorized data access necessitates a prompt response to prevent the compromise of internal infrastructure.

Immediate Action: Upgrade the HomeBox instance to version 0.26.0 or higher to implement the corrected notifier URL validation logic.

Proactive Monitoring: Review application access logs for unusual patterns of POST requests to the /v1/notifiers or /v1/notifiers/test endpoints, particularly those containing IPv6 address strings.

Compensating Controls: Restrict outbound network access from the HomeBox host using firewall rules to prevent unauthorized communication with internal metadata services (e.g., 169.254.169.254) or sensitive internal subnets.

Public Exploit Available: Unknown

The vulnerability represents a clear path for an authenticated attacker to perform internal reconnaissance and data theft. System administrators should prioritize upgrading to version 0.26.0 immediately. In environments where an immediate update is not feasible, ensure that the HomeBox service is segmented from sensitive internal resources and cloud metadata services to minimize the impact of a potential exploit.