Executive brief
link-preview-js is a JavaScript library that fetches and parses web page metadata for preview generation. A server-side request forgery (SSRF) vulnerability in versions before 2.1.17 allows attackers to bypass DNS rebinding protections and send arbitrary requests to local network resources, potentially exposing sensitive internal services or data.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) flaw caused by flawed DNS rebinding protection in link-preview-js versions before 2.1.17. An attacker can craft malicious input to bypass the DNS rebinding defenses, allowing them to make arbitrary HTTP requests to internal network addresses and read responses. This affects any application that uses the library to fetch link previews from user-supplied URLs without proper network isolation. The vulnerability was patched in version 2.1.17.
Affected products
- ospfranco link-preview-js before 2.1.17
Timeline
- 2022-07-02: disclosed
- 2022-07-02: patched: Fixed in version 2.1.17