External risk intelligence

Typebot SSRF Vulnerability Allows AWS Credential Theft

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-64709

Typebot is an open-source chatbot builder, a class of application typically deployed as an internet-facing web service to engage users. Because the vulnerable webhook component is part of the core functionality of a web-based chatbot platform designed to be accessible to external traffic, it is common for such services to be deployed in a public-facing configuration.

Server-Side Request Forgery

Typebot

before 3.13.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Typebot, an open-source chatbot builder, that could allow authenticated users to compromise the entire Kubernetes cluster and associated AWS infrastructure. This issue stems from a flaw in the webhook functionality that enables attackers to bypass security measures and gain unauthorized access to sensitive credentials.

Authenticated users can compromise cloud infrastructure.
Protects against unauthorized access to sensitive credentials.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Typebot can exploit a vulnerability in the webhook functionality to send requests from the server itself. By specifically targeting the AWS Instance Metadata Service and bypassing its security measures, the attacker can steal temporary security credentials. This compromised access can then be used to gain complete control over the Kubernetes cluster and any connected AWS resources.

Authenticated user access required.
Triggered via webhook HTTP requests.
Risk of full cloud compromise.

Live Threat

Current exploitation, exposure, and threat context

Authenticated users could abuse the webhook functionality to send arbitrary HTTP requests from the server, potentially accessing sensitive AWS metadata and credentials when the service is deployed in an AWS environment. This could lead to the compromise of the Kubernetes cluster and associated AWS infrastructure by bypassing IMDSv2 protection.

Server-side request forgery.
Arbitrary HTTP requests to AWS IMDS.
Kubernetes cluster and AWS infrastructure compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The discovery of a Server-Side Request Forgery (SSRF) vulnerability in Typebot's webhook functionality necessitates immediate action by teams responsible for the application and its underlying infrastructure. Platform or infrastructure teams managing the Kubernetes cluster and AWS environment should coordinate with application owners to identify all instances of Typebot, assess their reachability and criticality, and determine the accountable owner for remediation. The first practical step involves confirming the deployment footprint, verifying external exposure, and initiating a risk-based remediation plan, potentially involving vendor coordination or temporary mitigation measures.

Application and platform teams own remediation.
Verify Typebot instances and external reachability.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Typebot?

Typebot is an open-source platform used to build interactive chatbot workflows. It allows creators to design visual conversation flows that can be embedded into websites or applications to engage users, often functioning as a bridge between visitors and backend services via its webhook features.

What does CWE-918 mean for CVE-2025-64709?

CWE-918 is Server-Side Request Forgery (SSRF). This weakness allows an attacker to manipulate the server into making unintended requests to internal resources. In this specific case, the flaw in the webhook component lets the application be tricked into reaching out to local network services it should not access.

How is the Typebot webhook vulnerability triggered?

An attacker with authenticated access triggers the bug by sending specifically crafted HTTP requests through the webhook block. This does not occur through standard chatbot interaction alone; the attacker must have the ability to configure or influence the webhook functionality to inject custom headers that bypass security checks.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal notes that because Typebot is a chatbot builder, it is frequently deployed as an internet-facing service. If your instance is reachable from the public internet, the potential for unauthorized actors to reach the vulnerable webhook component is significantly higher.

How do I secure my Typebot instance?

The primary step is to update your Typebot deployment to version 3.13.1 or later, which resolves the flaw. Before applying the update, verify your current version and ensure that you have identified all running instances of the software within your Kubernetes clusters to ensure complete coverage.

References

github.com/baptisteArno/typebot.io/security/advisories/GHSA-8gq9…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.