Time-of-check Time-of-use (TOCTOU) Race Condition in Tolgee - #VU164332

Vulnerability details

The vulnerability allows a remote user to access internal services and cloud metadata endpoints and disclose configured API keys or webhook payloads through server-side request forgery.

The vulnerability exists due to a time-of-check time-of-use race condition in Tolgee's UrlSecurity validation and LLM provider and webhook request handling when outbound requests independently resolve previously validated hostnames. A remote user can save a URL resolving to a public address, change its DNS records to an internal address, and trigger an LLM request or webhook execution to redirect requests and sensitive data to that address.

Affected software

Remediation

External References

• https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-q6mm-jcr5-9qw2

Related Security Bulletins

• Time-of-check Time-of-use (TOCTOU) Race Condition in Tolgee