Plane Webhook Redirect Vulnerability

Plane, an open-source project management tool, has a webhook redirect vulnerability before version 1.4.0.

The webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after redirects is not checked.

A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API.

Affected versions: prior to 1.4.0. Fixed in 1.4.0.