Wallos vulnerabilities

Wallos before version 5.0.0 allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. An attacker can break out of the current VEVENT block and insert attacker-controlled calendar events, including spoofed organizers and email addresses, into any calendar application subscribed to that feed.

Wallos from version 2.0.0 to before 5.0.0 allows any authenticated user (no admin rights required) to make the server open arbitrary outbound SMTP connections to internal/link-local addresses by setting the SMTP host of their personal email notifications to an internal IP. Lack of SSRF validation in the notification settings endpoint and the notification cron leads to connections to the chosen host:port.

Wallos prior to version 5.0.0 allows any authenticated user to store an arbitrary SMTP host (including private and cloud-metadata IP addresses) in their email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to the specified address. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

Wallos before version 5.0.0 ships a second, near-identical, unauthenticated logo-image search endpoint (endpoints/payments/search.php) that was not hardened against SSRF. It passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY.

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.

Wallos before version 4.9.6 contains a path traversal vulnerability in the POST /endpoints/db/restore.php endpoint. The ZipArchive::extractTo() function does not validate entry names for '../' sequences, allowing an admin to upload a crafted zip with logos/../../endpoints/shell.php to write a webshell to the webroot. The extension filter only applies to the post-extraction logo copy step, so it does not prevent this attack.

Wallos before version 4.9.6 contains an SSRF vulnerability in the POST /endpoints/notifications/testemailnotifications.php endpoint. The smtpaddress and smtpport parameters are taken from the POST body with zero SSRF validation, and PHPMailer connects to the attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network and access cloud metadata.

Wallos before version 4.9.4 has an authentication bypass vulnerability in the endpoints/db/import.php endpoint. The only guard is a user-table row count – if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database.

Wallos before version 4.9.4 has a vulnerability in the OIDC mechanism. login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account.

Wallos before version 4.9.4 has an authentication bypass vulnerability in the endpoints/db/migrate.php endpoint. This endpoint executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, the endpoint currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of the authenticated user's credential. A normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The stats logic later dereferences that foreign ID without user_id scoping, allowing the attacker to infer the victim's monthly-normalized cost.

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window.

In Wallos prior to version 4.8.1, SSRF protection in endpoints/subscription/add.php and endpoints/payments/add.php does not block CGNAT addresses (100.64.0.0/10, RFC 6598). Authenticated users can perform Blind SSRF to internal services in Tailscale, Carrier-Grade NAT, and other environments. This issue has been patched in version 4.8.1.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the /endpoints/currency/currency component of Wallos v4.1.1. It allows attackers to execute arbitrary operations via a crafted GET request.