Ech0 Afectado por una Falsificación de Solicitud del Lado del Servidor No Autenticada en la Función de Vista Previa del Sitio Web

The SSRF vulnerability in Ech0 allows an attacker to leverage the platform's link preview functionality for malicious purposes. Because the /api/website/title endpoint is unauthenticated and accepts a fully attacker-controlled URL without proper validation, an attacker can craft a request to fetch content from internal services or external resources. This could lead to data exfiltration, reconnaissance of the internal network, and potentially even access to sensitive information stored behind firewalls. The InsecureSkipVerify: true setting on the outbound client further exacerbates the risk by bypassing SSL certificate verification, allowing connections to untrusted hosts. Exploitation could resemble similar SSRF attacks seen in other web applications where internal APIs are inadvertently exposed.

Organizations running Ech0 instances, particularly those with exposed instances or those that rely on the platform for internal idea sharing, are at risk. Shared hosting environments where multiple users share the same Ech0 instance are also particularly vulnerable, as an attacker could potentially exploit the vulnerability through another user's account.

• nodejs / server:

  journalctl -u ech0 -f | grep -i "io.ReadAll"

• generic web:

  curl -I <ech0_instance_url>/api/website/title?url=<malicious_url>
  # Check for unexpected server responses or internal IP addresses in the headers

1. 2026-04-06Disclosure

   disclosure

1. Reservado2026-03-31
2. Publicada2026-04-06
3. Modificada2026-04-07
4. EPSS actualizado2026-04-14

The primary mitigation for CVE-2026-35036 is to upgrade Ech0 to version 4.2.8 or later, which includes the necessary fixes to prevent the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /api/website/title endpoint with attacker-controlled URLs. Additionally, restrict network access to the Ech0 instance to only trusted sources. Review and strengthen the server's outbound network policies to prevent unauthorized connections. After upgrading, confirm the fix by attempting to trigger the link preview functionality with a known malicious URL and verifying that the request is blocked or handled securely.