Junglewise Threat Intelligence

CVE-2022-25876: link-preview-js server-side request forgery

CVE-2022-25876 · Severity: low · CVSS 3.1 · Published 2022-07-02

Technologies: Ospfranco Link-Preview-Js.

Executive brief

link-preview-js is a JavaScript library that fetches and parses web page metadata for preview generation. A server-side request forgery (SSRF) vulnerability in versions before 2.1.17 allows attackers to bypass DNS rebinding protections and send arbitrary requests to local network resources, potentially exposing sensitive internal services or data.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) flaw caused by flawed DNS rebinding protection in link-preview-js versions before 2.1.17. An attacker can craft malicious input to bypass the DNS rebinding defenses, allowing them to make arbitrary HTTP requests to internal network addresses and read responses. This affects any application that uses the library to fetch link previews from user-supplied URLs without proper network isolation. The vulnerability was patched in version 2.1.17.

Affected products

  • ospfranco link-preview-js before 2.1.17

Timeline

  • 2022-07-02: disclosed
  • 2022-07-02: patched: Fixed in version 2.1.17

References