important · Zero-click
A WhatsApp sender can make a default OpenWA gateway issue blind requests to internal services.
Affects
OpenWA, a self-hosted WhatsApp API gateway that links WhatsApp sessions to server-side automation and integrations.
Sending media to the linked WhatsApp number is enough to reach the default-enabled fetch path.
Detail and 2 sources
Sender-controlled media metadata selects the destination, including internal and link-local addresses, although the response body remains blind.
OpenWA 0.24.0 restricts these media fetches to WhatsApp hosts.