Agent WranglersEVT-26Required
Check webhook addresses before sending
Accept only public HTTPS addresses as webhook targets, and never let a webhook reach your internal network.
How to do it
Resolve the host on every send, and refuse private, loopback, link-local and cloud metadata addresses, in IPv4 and IPv6. Connect to the address you checked, so a DNS change can't swap it, and don't follow redirects. This is server-side request forgery protection.
How to check
Register https://169.254.169.254/ and https://localhost/ as webhook targets. Both are refused. Register a test host that resolves to a public address, then point its DNS at 127.0.0.1. The next send is refused and no request reaches the loopback address.
Sources
Related rules
- APS-41 Fetch only allowed addresses in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/events/webhooks/webhook-targets">Agent Wranglers integration and events playbook</a>. In code you write, add a comment next to it with the same link.