CVE-2024-39687: Fedify SSRF in DocLoader

CVE-2024-39687 · Severity: low · CVSS 3.1 · Published 2024-07-05

Fedify is a TypeScript library for building ActivityPub-compatible federated services. The library fails to validate that URIs in ActivityPub objects point to public addresses before fetching them, allowing attackers to craft malicious ActivityPub messages that force the server to access internal network resources, databases, or local files. This could expose sensitive internal data or enable attacks on backend systems.

Technologies: Fedify. Vendors: Fedify.

Quick answers

Is CVE-2024-39687 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-39687 being exploited in the wild.
How severe is CVE-2024-39687?
Low severity, with a CVSS score of 3.1, published 5 July 2024.
Which products and versions are affected?
Fedify <0.9.3, 0.10.0-0.10.1, 0.11.0-0.11.1.
Is there a fix for CVE-2024-39687?
A patch was published on 2024-07-05: Patches released: versions 0.9.3, 0.10.2, 0.11.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-39687 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-39687?
Check whether you run Fedify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in Fedify's DocLoader component. When fetching resources referenced by @id fields or media URLs from ActivityPub objects, the library does not validate that resolved hostnames are public IP addresses before issuing HTTP requests. An attacker can craft an ActivityPub activity containing URIs pointing to private IP ranges (127.0.0.1, 10.0.0.0/8, etc.), localhost services, or file:// URLs that the server will fetch and potentially expose. This is compounded by the lack of protocol whitelisting—non-HTTP/HTTPS schemes like FTP, data:, or CalDAV may also be exploitable. On Deno-based deployments, file:// URI access could leak local filesystem contents. The vulnerability was patched in versions 0.9.3, 0.10.2, and 0.11.2 via URI validation checks.

Affected products

  • Fedify Fedify <0.9.3, 0.10.0-0.10.1, 0.11.0-0.11.1

Identifiers

  • CVE-2024-39687
  • GHSA-p9cg-vqcc-grcx

Timeline

  • 2024-07-05: disclosed: Advisory published
  • 2024-07-05: patched: Patches released: versions 0.9.3, 0.10.2, 0.11.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.