3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68458

CVE-2025-68458: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). This issue has been patched in version 5.104.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68458

CVE-2025-68458:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
webpack	npm	>= 5.49.0, <= 5.104.0	5.104.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the HttpUriPlugin of webpack, specifically in how it validates URIs against the allowedUris configuration. The advisory and the provided proof-of-concept clearly demonstrate an SSRF vulnerability due to a bypass in the allow-list check. By analyzing the commits between the last vulnerable version (v5.104.0) and the first patched version (v5.104.1), I identified the security fix in commit c5100702335a9cdcb75558ccd80def2329bd4abf. The patch is located in lib/schemes/HttpUriPlugin.js within the apply method. The vulnerable logic resided in an inner function, isAllowed, which performed a simple string prefix check (startsWith) on the URI. This was insufficient and could be bypassed using a specially crafted URL containing a userinfo part (@). The fix involves parsing the URI with new URL() to correctly identify the origin before checking it against the allowedUris. Therefore, the HttpUriPlugin.apply method is the primary function that would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

HttpUriPlugin.apply

lib/schemes/HttpUriPlugin.js

The `apply` method of the `HttpUriPlugin` class contains an inner function `isAllowed` that is responsible for validating if a URI is present in the `allowedUris` list. The vulnerable implementation of this check used `uri.startsWith(allowed)` on the unprocessed URI string. This allows an attacker to bypass the check by crafting a URL with a userinfo component, such as `http://<allowed_uri>@<malicious_host>`. The `URL` constructor will parse this to connect to `<malicious_host>`, leading to a Server-Side Request Forgery (SSRF). The patch rectifies this by parsing the URI using `new URL(uri)` before performing the validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.