Executive brief
nossrf is a JavaScript library used to validate URLs and prevent server-side request forgery (SSRF) attacks. A flaw in its hostname validation allows attackers to bypass this protection by providing hostnames that resolve to local or private IP addresses, potentially enabling unauthorized access to internal systems and services.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) bypass in nossrf versions before 1.0.4, classified as CWE-918. The library's URL validation mechanism fails to properly check whether a provided hostname resolves to a local or reserved IP address space (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12). An attacker can bypass SSRF protection by crafting URLs with hostnames that resolve to such addresses, allowing requests to internal systems. The vulnerability requires no authentication or user interaction and is exploitable over the network via the library's validation API. The fix is available in version 1.0.4 and later.
Affected products
- nossrf nossrf before 1.0.4
Timeline
- 2025-03-23: disclosed
- 2025-03-23: patched: Fix available in version 1.0.4