6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xw57-23p8-9wc5

GHSA-xw57-23p8-9wc5: @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)

Finding

Location: core/src/shared/secure-fetch.ts:52-54

The localhost exception allowed localhost and 127.0.0.1 but did not cover 0.0.0.0, [::1] (IPv6 localhost), or the full 127.0.0.0/8 loopback range.

Status

Fixed in v0.2.136 — Localhost detection now covers localhost, 127.0.0.1, [::1], 0.0.0.0, and the full 127.x.x.x range.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-xw57-23p8-9wc5

GHSA-xw57-23p8-9wc5:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@asymmetric-effort/specifyjs	npm	< 0.2.136	0.2.136

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the assertSecureUrl function within core/src/shared/secure-fetch.ts. This function is responsible for ensuring that URLs passed to the secureFetch function are secure (i.e., use HTTPS). For development purposes, it includes an exception for localhost connections. However, the original implementation of this exception was incomplete. It only checked for the hostnames 'localhost' and '127.0.0.1'.

The patch, found in commit 25d1fb491d99479efdf501f5f75e0bb80c908f0a, rectifies this by expanding the check to include other common representations of the loopback address, such as '[::1]' (the standard IPv6 loopback address), '0.0.0.0' (which can resolve to localhost in some contexts), and any address starting with '127.', which covers the entire 127.0.0.0/8 IPv4 loopback range.

An attacker could have exploited this vulnerability by crafting a URL with a loopback address like http://[::1] or http://127.0.0.2. The vulnerable version of assertSecureUrl would not recognize this as a localhost address and, depending on the context where secureFetch is used (especially on a server), this could lead to a Server-Side Request Forgery (SSRF) attack, where the server is tricked into making a request to an internal service.

Vulnerable functions

assertSecureUrl

core/src/shared/secure-fetch.ts

The function `assertSecureUrl` contained an incomplete check for localhost addresses. The check only covered 'localhost' and '127.0.0.1', failing to account for other loopback addresses such as the IPv6 loopback '[::1]', '0.0.0.0', or other IPs in the '127.0.0.0/8' range. This flaw allowed an attacker to bypass the intended security restrictions by using an unlisted loopback address, potentially leading to a Server-Side Request Forgery (SSRF) vulnerability if the `secureFetch` function is used in a server-side context.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.