# The endpoint '/test/webhooks' is vulnerable to DNS Rebinding

Omise webhook endpoint accepted a rebind.network URL that alternated DNS resolution between an attacker server and 127.0.0.1, yielding blind SSRF against internal services.

- Payout: hidden
- Severity: medium
- Program: Omise
- Found by: sim4n6
- Disclosed: 2022-03-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1379656
- Library page: https://bugbountylibrary.com/r/h1%3A1379656
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:rest technique:race-window vuln:access-control vuln:ssrf

**Target:** Webhook configuration endpoint dashboard.omise.co/test/webhooks
**Root cause:** Webhook URL validation resolves the hostname once and blocks private IPs, but the server re-resolves the hostname at delivery time, so a rebinding DNS server can return a public IP at validation and 127.0.0.1 at request time.
**Steps:**
1. Create an Omise account and open `https://dashboard.omise.co/test/webhooks`.
2. Add webhook URL `https://A.178.62.122.208.1time.127.0.0.1.1time.repeat.rebind.network/webhook5` (rebind.network alternates resolution between 178.62.122.208 and 127.0.0.1).
3. If first resolution is 127.0.0.1 the app rejects it as private; retry until first resolution is the public IP so it saves.
4. Trigger a webhook event (e.g. create a recipient) so the server fetches the URL and, on a rebind, hits `https://127.0.0.1/else/internal`.
**How found:** Researcher noted the app blocks private IP webhook URLs, hypothesized validation-time vs delivery-time DNS resolution mismatch, and used rebind.network to alternate A records between a public server and 127.0.0.1.
**Exploitation:** Attacker registers a rebinding hostname that resolves to a public IP during validation and to 127.0.0.1 during delivery; each webhook-triggering action (e.g. creating a recipient) makes the Omise backend issue a blind HTTP request to an internal endpoint of the attacker's choosing via the path.
**Insight:** When a webhook/URL field rejects private IPs, test TOCTOU DNS rebinding: a hostname whose first resolution is public and later resolutions are 127.0.0.1 defeats one-shot validation; rebind.network encodes the alternation in the hostname itself.