Executive brief
Fedify is a TypeScript library for building ActivityPub-compatible federated services. The library fails to validate that URIs in ActivityPub objects point to public addresses before fetching them, allowing attackers to craft malicious ActivityPub messages that force the server to access internal network resources, databases, or local files. This could expose sensitive internal data or enable attacks on backend systems.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in Fedify's DocLoader component. When fetching resources referenced by @id fields or media URLs from ActivityPub objects, the library does not validate that resolved hostnames are public IP addresses before issuing HTTP requests. An attacker can craft an ActivityPub activity containing URIs pointing to private IP ranges (127.0.0.1, 10.0.0.0/8, etc.), localhost services, or file:// URLs that the server will fetch and potentially expose. This is compounded by the lack of protocol whitelisting—non-HTTP/HTTPS schemes like FTP, data:, or CalDAV may also be exploitable. On Deno-based deployments, file:// URI access could leak local filesystem contents. The vulnerability was patched in versions 0.9.3, 0.10.2, and 0.11.2 via URI validation checks.
Affected products
- Fedify Fedify <0.9.3, 0.10.0-0.10.1, 0.11.0-0.11.1
Timeline
- 2024-07-05: disclosed: Advisory published
- 2024-07-05: patched: Patches released: versions 0.9.3, 0.10.2, 0.11.2