ssrf

CVE-2025-2691: Server-Side Request Forgery (SSRF) Vulnerability in nossrf

Robert Morgan

Robert Morgan

— 6 min read

Executive Summary

CVE-2025-2691 describes a critical Server-Side Request Forgery (SSRF) vulnerability affecting versions of the nossrf Node.js package prior to 1.0.4. This vulnerability allows an attacker to bypass the intended SSRF protection mechanism by providing a hostname that resolves to a local or reserved IP address. Successful exploitation can lead to information disclosure, internal service access, and potentially other malicious activities depending on the application's architecture and the services accessible from the vulnerable server. The vulnerability has a CVSS v3.1 score of 8.2 (High) and a CVSS v4.0 score of 8.8 (High), indicating a significant risk. A proof-of-concept exploit exists, highlighting the potential for real-world attacks.

Technical Details

The nossrf package is designed to prevent Server-Side Request Forgery attacks by validating the target hostname or IP address before making an external HTTP request. The vulnerability, identified as CVE-2025-2691, arises from an insufficient validation mechanism that can be circumvented by providing a hostname that, while seemingly innocuous, resolves to an internal or reserved IP address.

Affected Systems:

  • Any system utilizing the nossrf package for SSRF protection.
  • Specifically, applications using nossrf versions prior to 1.0.4.

Affected Software Versions:

  • nossrf versions < 1.0.4

Affected Components:

The core component affected is the hostname validation logic within the nossrf package. This logic is intended to prevent requests to internal or reserved IP addresses, but it fails to adequately handle certain hostname resolution scenarios.

Attack Vector:

The attack vector is network-based. An attacker can inject a malicious hostname into an application that uses nossrf to perform HTTP requests. This hostname, when resolved by the server, points to an internal resource.

Root Cause Analysis

The root cause of CVE-2025-2691 lies in the flawed hostname validation within the nossrf package. The package likely attempts to prevent SSRF by checking if the resolved IP address of a given hostname falls within a range of reserved or private IP addresses (e.g., 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). However, the validation logic fails to account for various techniques that can be used to bypass these checks.

One common bypass technique involves using DNS rebinding. DNS rebinding exploits the Time-To-Live (TTL) value of DNS records. The attacker registers a domain name and initially configures it to resolve to a public IP address. The vulnerable application performs the initial DNS resolution and passes the initial check. Subsequently, the attacker changes the DNS record to point to a private IP address and reduces the TTL to a very small value (e.g., 1 second). When the application attempts to establish a connection to the resolved IP address, it may re-resolve the hostname due to the short TTL, now obtaining the private IP address.

Another bypass technique involves using alternative IP address representations. For example, an attacker might use an octal or hexadecimal representation of an IP address, which may not be correctly parsed by the validation logic.

Consider the following simplified (and vulnerable) example of how nossrf might have implemented its validation logic:

function isSafeHostname(hostname) {
  const ip = require('net').isIP(hostname) ? hostname : require('dns').lookupSync(hostname);

  if (!ip) {
    return false; // Unable to resolve hostname
  }

  const ipParts = ip.split('.');
  const firstOctet = parseInt(ipParts[0], 10);

  // Check for common private IP ranges (INCOMPLETE AND VULNERABLE)
  if (firstOctet === 10 || firstOctet === 127 || (firstOctet === 192 && parseInt(ipParts[1], 10) === 168)) {
    return false; // Hostname resolves to a private IP address
  }

  if (firstOctet === 172 && parseInt(ipParts[1], 10) >= 16 && parseInt(ipParts[1], 10) <= 31) {
    return false; // Hostname resolves to a private IP address
  }

  return true; // Hostname appears safe
}

function makeRequest(hostname) {
  if (!isSafeHostname(hostname)) {
    throw new Error('Unsafe hostname');
  }

  // Vulnerable code: Making request without proper SSRF protection
  const https = require('https');
  https.get(`https://${hostname}`, (res) => {
    console.log('statusCode:', res.statusCode);

    res.on('data', (d) => {
      process.stdout.write(d);
    });

  }).on('error', (e) => {
    console.error(e);
  });
}

// Example usage (VULNERABLE):
makeRequest('localhost'); // This would be blocked by the naive check

This example is vulnerable because:

  1. It uses dns.lookupSync, which can be susceptible to DNS spoofing and doesn't handle asynchronous resolution properly.
  2. The IP range check is incomplete and doesn't cover all reserved IP ranges or bypass techniques.
  3. It doesn't account for DNS rebinding attacks.
  4. It doesn't validate the IP address format correctly (e.g., hexadecimal or octal representations).

A more robust (but still potentially incomplete) validation might look like this:

const dns = require('dns');
const net = require('net');

async function isSafeHostname(hostname) {
  try {
    const ipAddresses = await dns.promises.resolve(hostname);

    for (const ip of ipAddresses) {
      if (net.isIP(ip)) {
        const ipParts = ip.split('.');
        const firstOctet = parseInt(ipParts[0], 10);

        if (firstOctet === 10 || firstOctet === 127) {
          return false; // Private IP
        }

        if (firstOctet === 192 && parseInt(ipParts[1], 10) === 168) {
          return false; // Private IP
        }

        if (firstOctet === 172 && parseInt(ipParts[1], 10) >= 16 && parseInt(ipParts[1], 10) <= 31) {
          return false; // Private IP
        }

        // Check for link-local addresses (169.254.x.x)
        if (firstOctet === 169 && parseInt(ipParts[1], 10) === 254) {
          return false;
        }

        // Check for reserved IP ranges (0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, 192.0.2.0/24, 198.18.0.0/15)
        if (firstOctet === 0 || (firstOctet === 100 && parseInt(ipParts[1], 10) >= 64 && parseInt(ipParts[1], 10) <= 73) || (firstOctet === 192 && (parseInt(ipParts[1], 10) === 0 && parseInt(ipParts[2], 10) === 0)) || (firstOctet === 192 && parseInt(ipParts[1], 10) === 0 && parseInt(ipParts[2], 10) === 2) || (firstOctet === 198 && parseInt(ipParts[1], 10) >= 18 && parseInt(ipParts[1], 10) <= 31)) {
            return false;
        }

        // Check for IPv6 loopback address (::1) and link-local addresses (fe80::/10)
        if (ip === '::1' || ip.startsWith('fe8')) {
          return false;
        }

      } else {
        return false; // Invalid IP address
      }
    }

    return true; // All resolved IPs appear safe
  } catch (error) {
    console.error("DNS resolution error:", error);
    return false; // Treat resolution errors as unsafe
  }
}

async function makeRequest(hostname) {
  if (!(await isSafeHostname(hostname))) {
    throw new Error('Unsafe hostname');
  }

  // Vulnerable code: Making request without proper SSRF protection
  const https = require('https');
  https.get(`https://${hostname}`, (res) => {
    console.log('statusCode:', res.statusCode);

    res.on('data', (d) => {
      process.stdout.write(d);
    });

  }).on('error', (e) => {
    console.error(e);
  });
}

// Example usage (VULNERABLE):
makeRequest('example.com');

Key improvements in this second example:

  1. Asynchronous DNS Resolution: Uses dns.promises.resolve for asynchronous DNS resolution, which is generally preferred over synchronous methods to avoid blocking the event loop.
  2. Multiple IP Addresses: Handles cases where a hostname resolves to multiple IP addresses.
  3. Comprehensive IP Range Checks: Includes checks for more reserved and private IP ranges, including IPv6.
  4. Error Handling: Includes error handling for DNS resolution failures.

However, even this improved version might still be vulnerable to advanced SSRF bypass techniques.

Mitigation Strategies

To mitigate CVE-2025-2691, the following strategies are recommended:

  1. Upgrade nossrf: The most straightforward solution is to upgrade the nossrf package to version 1.0.4 or later. This version contains a fix for the SSRF vulnerability.

    npm install nossrf@latest

  2. Input Validation and Sanitization: Implement robust input validation and sanitization on the server-side to prevent attackers from injecting malicious hostnames. This includes:

    • Hostname Whitelisting: Restrict allowed hostnames to a predefined list of trusted domains. This is the most secure approach when the set of allowed destinations is known.

      const allowedHostnames = ['example.com', 'api.example.com'];

function isAllowedHostname(hostname) {
  return allowedHostnames.includes(hostname);
}

async function makeRequest(hostname) {
  if (!isAllowedHostname(hostname)) {
    throw new Error('Hostname not allowed');
  }

  // ... (rest of the request logic)
}

    • Regular Expression Validation: Use regular expressions to enforce a strict format for hostnames.

      function isValidHostname(hostname) {
  const hostnameRegex = /^[a-zA-Z0-9.-]+$/; // Example: Allow only alphanumeric characters, dots, and hyphens
  return hostnameRegex.test(hostname);
}

async function makeRequest(hostname) {
  if (!isValidHostname(hostname)) {
    throw new Error('Invalid hostname format');
  }

  // ... (rest of the request logic)
}

    • IP Address Validation: If IP addresses are allowed, validate that they are not within reserved or private IP ranges.

  3. Network Segmentation: Implement network segmentation to isolate internal services from the external network. This limits the impact of a successful SSRF attack by preventing access to sensitive resources.

  4. Principle of Least Privilege: Grant only the necessary permissions to the application making the external requests. Avoid running the application with elevated privileges.

  5. Disable Unnecessary Protocols: Disable any unnecessary protocols (e.g., file://, gopher://) that could be exploited through SSRF.

  6. Use a Web Application Firewall (WAF): Deploy a WAF to detect and block malicious requests, including those attempting to exploit SSRF vulnerabilities. Configure the WAF with rules to identify and block requests targeting internal IP addresses or using suspicious hostnames.

  7. Monitor Outbound Traffic: Monitor outbound network traffic for suspicious activity, such as requests to internal IP addresses or unusual ports.

  8. Implement Rate Limiting: Implement rate limiting to prevent attackers from making a large number of requests in a short period of time, which can help to mitigate the impact of SSRF attacks.

  9. Content Security Policy (CSP): Use CSP headers to restrict the domains that the application is allowed to make requests to. This can help to prevent SSRF attacks by limiting the attacker's ability to make requests to arbitrary domains.

Timeline of Discovery and Disclosure

  • Vulnerability Discovered: (Information not available)
  • Vulnerability Reported: (Information not available)
  • Patch Released: nossrf version 1.0.4
  • Public Disclosure: March 23, 2025

References

Read more