Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dssrf | npm | <= 1.0.3 | 1.0.4 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the dssrf package because of an incorrect order of operations in the is_url_safe and is_redirect_safe functions located in src/helpers.ts. The core of the issue is the use of the remove_at_symbol_in_string function on the raw URL string before it is parsed by new URL(). The '@' symbol in a URL is critical as it separates the userinfo (username and password) from the host. By stripping this character pre-parsing, a malicious URL like http://evil.com@127.0.0.1/ is transformed into http://evil.com127.0.0.1/. The subsequent security checks then operate on this corrupted hostname (evil.com127.0.0.1), which does not resolve to an internal IP, thus bypassing the intended SSRF protection. The HTTP client, however, correctly interprets the original URL and connects to the internal IP 127.0.0.1. The patch rectifies this by removing the call to remove_at_symbol_in_string and instead introduces a check after URL parsing to ensure that the username and password fields are empty, effectively rejecting any URL containing userinfo.
is_url_safesrc/helpers.ts
is_redirect_safesrc/helpers.ts