Unauthenticated SSRF in Ech0 via /api/website/title (CVE-2026-35037)

Metadata

Affected Target

Summary

Ech0’s GET /api/website/title endpoint fetches a URL supplied by the (unauthenticated) caller to extract a website’s title, without restricting the target to safe, external hosts. This allows an unauthenticated attacker to force the Ech0 server to make requests to internal-only services, cloud metadata endpoints, or other network-restricted resources.

Vulnerability Details

Root Cause

The /api/website/title endpoint performs an outbound HTTP fetch of an attacker-supplied URL with no allow-list/deny-list validation of the target host.

Attack Vector

1. Send an unauthenticated GET request to /api/website/title with a url parameter pointing at an internal service or metadata endpoint.
2. Ech0’s server-side fetch reaches the internal target on the attacker’s behalf.
3. The response (or side effects of reaching that internal target) leak information about the internal network.

Impact

Unauthenticated SSRF allowing reconnaissance/access to internal-only network resources reachable from the Ech0 host.

Environment / Lab Setup

Target:   lin-snow/Ech0 <= 4.2.1 / prior to 4.2.8
Attacker: Docker (self-contained isolated lab), a local evidence server, curl/nuclei

Proof of Concept

PoC Script

See verify-cve-2026-35037.sh and CVE-2026-35037.yaml (nuclei template) in this folder.

1

./verify-cve-2026-35037.sh <target-url>

Spins up a controlled local evidence server and drives Ech0’s title-fetch endpoint to request it, confirming the SSRF without touching cloud metadata or third-party infrastructure.

Detection & Indicators of Compromise

Signs of compromise:

• Outbound requests from the Ech0 host to internal-only services or 169.254.169.254 (cloud metadata)

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/fineman999/POC_CVE-2026-35037 on 2026-07-05.