🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rosecurify.com/two-cves-zero-ego-a-mailpit-story/
• Blog Title: Two CVEs, Zero Ego: A Mailpit Story
• Suggested Section: Pentesting Web -> SSRF (Server Side Request Forgery) (add/expand: SSRF via URL-fetch/proxy endpoints, include IMDS 169.254.169.254 example) and Pentesting Web -> WebSocket Attacks (add/expand: Cross-Site WebSocket Hijacking / Origin check bypass in Gorilla WebSocket CheckOrigin + no-auth impact)

🎯 Content Summary

Title: Two CVEs, Zero Ego: A Mailpit Story

Context: what Mailpit is and why it matters
Mailpit is a lightweight email testing tool for development environments. It runs an SMTP server to catch inbound emails and exposes a web interface/API to view them. It is written in Go, distributed as a single binary, and is commonly run locally or via Docker. Because it captures sensitive emails (password resets, verification codes, magic links, tokens), any exposure of its HTTP/W...

🔧 Technical Details

SSRF via “proxy URL fetch” endpoints: If an application exposes an endpoint that fetches arbitrary URLs (e.g., /api/v1/proxy?url=...) and does not strictly validate destinations (allowlist approved hosts/schemes and block internal/link-local ranges), an attacker can coerce the server into making requests from its own network context. A common high-impact target in cloud environments is AWS IMDS at http://169.254.169.254/latest/meta-data/, which can expose internal metadata and sometimes credentials, enabling follow-on compromise and lateral movement.

Cross-Site WebSocket Hijacking from permissive Origin validation: If a WebSocket server disables origin checks (e.g., Gorilla WebSocket Upgrader.CheckOrigin always returns true), attacker-controlled websites can run JavaScript that opens cross-site WebSocket connections to a target. If the WebSocket channel lacks authentication/authorization, this enables cross-site...

🤖 Agent Actions

Updated HackTricks with Mailpit-derived techniques:

• SSRF page: Added guidance on exploiting proxy/fetch endpoints as SSRF primitives with an IMDS (169.254.169.254) example plus key mitigations; appended blog reference.
• WebSocket attacks page: Documented Gorilla WebSocket CheckOrigin always-true misconfiguration leading to cross-site hijacking without auth, with exploitation snippet and mitigations; added blog reference.

Tests were not run (documentation-only changes).

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.