Executive brief
ssrf-agent is a Node.js library used to safely validate and filter HTTP requests by checking IP addresses. A flaw in the defaultIpChecker function fails to properly reject requests to private IP ranges, allowing attackers to bypass security controls and access internal services or metadata endpoints that should be restricted.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) caused by improper IP address validation in the defaultIpChecker function of ssrf-agent versions before 1.0.5. The function fails to correctly identify and reject private IP addresses (including IPv6 formats), allowing an attacker to craft requests to internal network resources. The vulnerability requires the attacker to control the target URL supplied to the library but does not require authentication or special user interaction beyond a normal application request. An attacker can use this to access internal services, cloud metadata endpoints, or other restricted resources. The fix was released in version 1.0.5.
Affected products
- welefen ssrf-agent before 1.0.5
Timeline
- 2021-12-02: disclosed
- 2021-12-02: patched: Fix released in version 1.0.5