2 ms·
I work on security at PostHog. We resolved these SSRF findings back in October 2024 when this report was responsibly disclosed to us. I'm currently gathering th
by piccirello 10mo ago
I work on security at PostHog. We resolved these SSRF findings back in October 2024 when this report was responsibly disclosed to us. I'm currently gathering the relevant PRs so that we can share them here. We're also working on some architectural improvements around egress, namely using smokescreen, to better protect against this class of issue.
- piccirello 10mo agoHere's the PR[0] that resolved the SSRF issue. This fix was shipped within 24 hours of receiving the initial report. It's worth noting that at the time of this report, this only affected PostHog's single tenant hobby deployment (i.e. our self hosted version). Our Cloud deployment used our Rust service for sending webhooks, which has had SSRF protection since May 2024[1]. Since this report we've evolved our Cloud architecture significantly, and we have similar IP-based filtering throughout our backend services. [0] https://github.com/PostHog/posthog/pull/25398 https://github.com/PostHog/posthog/pull/25398 [1] https://github.com/PostHog/posthog/commit/281af615b4874da1b89915a6ccd36d74be5a04a0 https://github.com/PostHog/posthog/commit/281af615b4874da1b8...