txtdot SSRF vulnerability in /proxy

The SSRF vulnerability in txtdot allows an attacker to bypass network security controls and access internal resources that are not directly accessible from the outside world. An attacker could, for example, scan internal ports, access internal APIs, or retrieve sensitive data from internal databases or file servers. The blast radius extends to any internal service accessible via HTTP GET requests. Successful exploitation could lead to data breaches, unauthorized access to internal systems, and potentially, further compromise of the network. The ability to proxy requests through txtdot effectively grants the attacker a foothold within the internal network.

Organizations running txtdot as a proxy server, particularly those with sensitive internal resources accessible via HTTP, are at risk. Shared hosting environments where txtdot is deployed alongside other applications are also vulnerable, as a compromise of one application could lead to exploitation of this SSRF vulnerability.

• nodejs / server:

  ps aux | grep txtdot
  journalctl -u txtdot -f

• generic web:

  curl -I http://<txtdot_server>/proxy?url=http://internal-resource
  # Check for 200 OK response or other unexpected behavior

1. 2024-07-26Disclosure

   disclosure

1. Reserviert2024-07-22
2. Veröffentlicht2024-07-26
3. Geändert2024-08-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-41813 is to upgrade to version 1.6.1 of txtdot. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict network access to the txtdot server to only trusted sources using firewall rules or network segmentation. Implement input validation on the /proxy route to prevent attackers from specifying arbitrary target URLs. Monitor txtdot logs for suspicious outbound requests. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter malicious requests. After upgrading, confirm the fix by attempting to send a request to an internal resource through the /proxy route; the request should be blocked.