Listen to this Post
How the CVE Works
The vulnerability in WebFinger.js arises from improper validation of user-supplied addresses in the lookup function. The library fails to block localhost or internal LAN addresses (e.g., 192.168.x.x), allowing attackers to craft malicious addresses like user@localhost:7000/admin/restricted_page?. The host extraction logic splits the input at the `@` symbol, enabling SSRF by forcing the server to send requests to unintended internal endpoints. The flawed `__isLocalhost` check only matches “localhost” with a port, ignoring variations like 127.0.0.1. This lets attackers bypass restrictions and access sensitive internal paths, leading to blind SSRF exploits.
DailyCVE Form
Platform: WebFinger.js
Version: <1.0.3
Vulnerability: SSRF
Severity: Critical
Date: 2023-XX-XX
Prediction: Patch expected 2023-XX-XX
What Undercode Say
curl "http://localhost:3000/api/v1/search_user?search=user@localhost:1234/secret.txt?"
if (address.indexOf('://') > -1) {
host = address.replace(/ /g,'').split('/')[bash];
} else {
host = address.replace(/ /g,'').split('@')[bash];
}
How Exploit
1. Craft malicious address: `user@localhost:1234/secret.txt?`
2. Trigger lookup via API endpoint.
3. Server fetches internal `/secret.txt` via SSRF.
Protection from this CVE
- Block localhost/LAN addresses.
- Strict input validation.
- Update to patched version.
Impact
- Unauthorized internal data access.
- Blind SSRF exploitation.
- Network service compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
