6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54590

CVE-2025-54590: webfinger.js is vulnerable to Blind SSRF attacks through localhost

webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing access to localhost services in production. This library does not prevent localhost access, only checking for hosts that start with "localhost" and end with a port. Users can exploit this by creating servers that send GET requests with controlled host, path, and port parameters to query services on the instance's host or local network, enabling blind SSRF attacks. This is fixed in version 2.8.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54590

CVE-2025-54590:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
webfinger.js	npm	<= 2.8.0	2.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the webfinger.js library. The root cause lies in insufficient validation of user-provided addresses within the lookup function. The function would extract the host from an address string (e.g., user@host) by simply taking the substring after the '@' symbol. This allowed an attacker to include a path and query parameters in the host portion (e.g., user@internal-server/admin/delete?user=victim), causing the library to make a request to an arbitrary internal endpoint.

The patch addresses this in multiple layers:

Host Sanitization: A new validateHost function is introduced to strip any path components (/, ?, #) from the extracted host, ensuring only a valid hostname or IP address is used.
Private Address Blocking: A new isPrivateAddress function checks the sanitized host against a comprehensive blocklist of private, local, and reserved IP ranges (both IPv4 and IPv6). This is the primary defense against SSRF.
DNS-based SSRF Protection: For Node.js environments, a validateDNSResolution function was added. It resolves hostnames to their IP addresses and checks if any of them are in the private address blocklist. This prevents attacks where a public domain resolves to a private IP (e.g., localtest.me resolving to 127.0.0.1).
Redirect Validation: The fetchJRD function was modified to handle redirects manually. It now validates the Location header of any redirect response to ensure it does not point to a private address, closing another potential SSRF vector.

The primary vulnerable function is WebFinger.lookup, as it's the entry point that consumes the malicious input. The WebFinger.fetchJRD function was also vulnerable due to its handling of redirects. The new functions (validateHost, isPrivateAddress, validateDNSResolution) represent the security controls that were missing.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.