Executive brief
Summaly is a library used to extract metadata and summaries from web pages. The vulnerability allows an attacker to bypass IP filtering restrictions by crafting an HTTP redirect response, enabling probing of internal network services that should be inaccessible. This could expose sensitive information from a victim's internal infrastructure without leaving obvious traces.
Technical details
This is an origin validation error (CWE-346) in the summaly library's private IP address filtering logic. The vulnerability occurs in the got.scpaping module: Summaly first makes an HTTP HEAD request and validates that the response does not contain private IP addresses, but then makes a follow-up HTTP GET request without applying the same validation. An attacker can craft a server that responds to HEAD requests with success, then responds to GET requests with an HTTP redirect to a private IP address (e.g., 127.0.0.1), bypassing the filter. The attack requires network reachability to the summaly server and no authentication. An attacker can achieve internal network reconnaissance and potential data extraction from otherwise-protected services. The fix was released in version 5.2.1.
Affected products
- misskey-dev summaly >=5.1.0, <5.2.1
Timeline
- 2025-05-06: disclosed
- 2025-05-06: patched: Fixed in version 5.2.1