Listen to this Post
The vulnerability resides in the `isPublicUrl` function which validates webhook URLs. It uses a blocklist of regex patterns to match the hostname string against known private IP ranges (e.g., 127.0.0.1, 192.168.x.x). This validation is flawed and can be bypassed in two primary ways. First, via DNS rebinding: a domain like `localtest.me` (a public domain that resolves to 127.0.0.1) passes the hostname check but causes the server to connect to localhost. Second, via open redirects: a URL to a trusted public service like `httpbin.org/redirect-to?url=http://127.0.0.1` passes the initial validation. When the server’s HTTP client follows the redirect, it is directed to the internal IP address, bypassing the filter.
dailycve form:
Platform: Hemmelig.app
Version: Unspecified
Vulnerability: SSRF filter bypass
Severity: Medium
date: 2024-10-09
Prediction: 2024-11-20
What Undercode Say:
`node -e “require(‘http’).createServer((req,res)=>{console.log(req.method,req.url,req.headers);res.end(‘ok’)}).listen(8080,()=>console.log(‘Listening on 8080’))”`
`export const isPublicUrl = (url: string): boolean => { const parsed = new URL(url); const hostname = parsed.hostname.toLowerCase(); const blockedPatterns = [ /^localhost$/, /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/, /^192\.168\.\d{1,3}\.\d{1,3}$/, ]; return !blockedPatterns.some((pattern) => pattern.test(hostname)); };`
How Exploit:
1. Authenticate as user.
2. Navigate to Secret Requests.
3. Input bypass payload.
4. Confirm secret creation.
5. Server triggers internal request.
Protection from this CVE:
`import { isIP } from ‘is-ip’; import dns from ‘dns/promises’; export const isPublicUrl = async (url: string): Promise
Impact:
Blind SSRF.
Internal network probe.
Port scanning possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
