6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j5qp-p44g-2m49

GHSA-j5qp-p44g-2m49: @asymmetric-effort/specifyjs: No redirect target validation in secureFetch

Finding

Location: core/src/shared/secure-fetch.ts

assertSecureUrl validated only the initial request URL. The fetch() API follows redirects by default (up to 20 hops). A request to a valid https:// URL could redirect to http://internal-service/ or other unvalidated destinations.

Status

Fixed in v0.2.136 — secureFetch now defaults to redirect: 'error' which rejects any redirect. Callers can override with { redirect: 'follow' } if they trust the target.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j5qp-p44g-2m49

GHSA-j5qp-p44g-2m49:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@asymmetric-effort/specifyjs	npm	< 0.2.136	0.2.136

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the @asymmetric-effort/specifyjs package, specifically within the secureFetch function located in core/src/shared/secure-fetch.ts. The root cause is that the fetch API, which secureFetch wraps, follows HTTP redirects by default. The secureFetch function would validate the initial URL using assertSecureUrl, but it would not validate the URLs of any subsequent redirects. This allowed an attacker to provide a valid https:// URL that redirects to an internal or insecure http:// URL, thus bypassing the security checks. The patch addresses this by changing the default behavior of secureFetch to prohibit redirects by setting redirect: 'error' in the options passed to fetch. Additionally, a related flaw in assertSecureUrl was fixed; previously, it would silently ignore unparseable URLs, which is also addressed in the patch by throwing an error. Therefore, secureFetch is the primary vulnerable function, as it is the entry point for the vulnerable operation, and assertSecureUrl is a key component in the vulnerable logic.

Vulnerable functions

secureFetch

core/src/shared/secure-fetch.ts

The `secureFetch` function was vulnerable because it used the default `fetch` behavior, which is to follow redirects (`redirect: 'follow'`). An attacker could provide a secure URL that redirects to an insecure or malicious URL, bypassing the initial URL validation performed by `assertSecureUrl`. This could lead to Server-Side Request Forgery (SSRF). The fix is to disable redirects by default by setting `redirect: 'error'`.

assertSecureUrl

core/src/shared/secure-fetch.ts

The `assertSecureUrl` function, which is called by `secureFetch`, had a flaw where it would silently fail and return if a URL was unparseable. This would allow the subsequent `fetch` call to proceed with a potentially malicious, unvalidated URL. This function is part of the exploitation chain for the main SSRF vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.