Executive brief
webfinger.js is a JavaScript library used by ActivityPub-compliant social networking applications to perform user account lookups. The library fails to properly validate hostnames in lookup requests, allowing attackers to craft malicious input that redirects requests to internal services (localhost, private IPs) or arbitrary paths on any host. An attacker can exploit this to probe for and potentially interact with vulnerable services running on the application server or internal network, compromising confidentiality and enabling reconnaissance for further attacks.
Technical details
The lookup function in webfinger.js contains a blind server-side request forgery (SSRF) vulnerability due to insufficient hostname validation. The vulnerable code extracts the hostname from user-supplied addresses by naive string splitting (e.g., splitting on '@' or '/'), without proper URL parsing or filtering of localhost and private IP ranges. The localhost detection check only matches strings literally starting with "localhost" and ending with a port, missing variations like "127.0.0.1" or "localhost:1234/path". Additionally, the attacker can inject path components (e.g., "user@localhost:7000/admin/restricted") which bypass the intended "/.well-known/webfinger" path restriction. An unauthenticated attacker can pass a specially crafted user address to trigger arbitrary GET requests to internal hosts and paths. The vulnerability is network-accessible with no authentication required. Patch version 2.8.1 is available.
Affected products
- silverbucket webfinger.js <= 2.8.0
Timeline
- 2025-07-27: disclosed
- 2025-07-28: patched: Version 2.8.1 released