TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings, but the forwarding code uses the raw `ky` instance instead of the repository's SSRF-protected `safeKy` client.
A workspace user who can configure WhatsApp settings can therefore make the Typebot server issue HTTP requests to internal services, private-network hosts, localhost, or metadata-style endpoints whenever the public WhatsApp production webhook receives a status payload that should be forwarded. Version 3.17.0 patches the issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
baptistearno:typebot.io
References 4
https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4…
https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-5c92-7q58-4rgx
https://github.com/baptisteArno/typebot.io/pull/2497
https://github.com/baptisteArno/typebot.io/pull/2497
https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0…
https://github.com/baptisteArno/typebot.io/commit/30cbc616e00efabb193c3221b36a0d417152592c
https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0
https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0