Strapi allows Server-Side Request Forgery in Webhook function
In Strapi latest version, at function Settings -> Webhooks, the application allows us to input a URL in order to create a Webook connection. However, we can input into this field the local domains such as localhost, 127.0.0.1, 0.0.0.0,…. in order to make the Application fetching into the internal itself, which causes the vulnerability Server - Side Request Forgery (SSRF).