Hatchet SNS UnsubscribeConfirmation SSRF via Signature-Excluded URL Field

Technical Analysis

The vulnerability lives in internal/integrations/ingestors/sns/sns.go, where VerifyPayload() confirms the AWS SNS message signature, but BuildSignature() deliberately omits the UnsubscribeURL field from the signed content. Because the field is unsigned, an authenticated Hatchet tenant can submit an otherwise validly-signed SNS UnsubscribeConfirmation message with a modified UnsubscribeURL pointing to an internal address (e.g., 169.254.169.254 for EC2 IMDS, or other internal-only HTTP services). The handler then calls http.Get() directly on this attacker-controlled URL from the server, granting the attacker a server-side request primitive that can retrieve IAM role credentials from instance metadata or reach internal APIs not otherwise exposed. This crosses a trust boundary between the orchestration platform's backend and its internal network, and in AI agent deployments could lead to compromise of credentials used by agent tooling or orchestration services.

Affected Systems

Hatchet

Detection Signatures

• Outbound HTTP GET requests from Hatchet server processes to internal IP ranges (169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) originating from SNS ingestor code paths
• SNS UnsubscribeConfirmation messages where UnsubscribeURL host does not match expected AWS SNS unsubscribe endpoint domains (sns.*.amazonaws.com)
• Log entries showing sns.go handler making requests to non-AWS domains
• Unexpected IMDS credential retrieval requests correlated with SNS webhook processing timestamps

Remediation Steps

1. 1

   Upgrade Hatchet

   Update to Hatchet version 0.91.1 or later, which fixes the signature validation gap for the UnsubscribeURL field.

2. 2

   Validate UnsubscribeURL against allowlist

   Ensure any code handling SNS UnsubscribeConfirmation messages validates that UnsubscribeURL matches expected AWS SNS domains before making outbound requests, regardless of signature status.

3. 3

   Block IMDS access from application servers

   Enforce IMDSv2 and/or use network policies/firewall rules to prevent application servers from reaching the instance metadata service unless explicitly required.

4. 4

   Apply egress filtering

   Restrict outbound HTTP requests from Hatchet server processes to only known, necessary external endpoints to reduce SSRF blast radius.

5. 5

   Audit IAM role scoping

   Ensure the IAM role attached to Hatchet server instances follows least privilege, limiting damage if credentials are exposed via IMDS.