TerriaJS-Server hat eine Domain-Validierungs-Bypass-Schwachstelle in seiner Proxy-Allowlist.

This vulnerability allows an attacker to bypass proxy restrictions within terrajs-server. The flawed validation logic only checks if a hostname ends with an allowed domain, rather than requiring an exact match. This means an attacker could register a malicious domain (e.g., maliciousexample.com) and configure terrajs-server to proxy content through it, even if example.com is the only allowed domain. This effectively circumvents the intended security controls, potentially exposing sensitive data or allowing the attacker to inject malicious content into proxied requests. The blast radius extends to any user or system relying on terrajs-server's proxy functionality for security or content filtering.

Organizations using terrajs-server for proxying web traffic, particularly those with sensitive data or critical services, are at risk. Shared hosting environments where multiple users share a terrajs-server instance are also particularly vulnerable, as a compromise of one user's account could potentially affect others.

• nodejs / server:

  ps aux | grep terrajs-server

• nodejs / server:

  find / -name "proxyableDomains" -type f

• generic web: Check terrajs-server logs for requests to unexpected or unauthorized domains. Look for patterns indicating proxy bypass attempts. • generic web: Review terrajs-server configuration files for overly permissive proxyableDomains settings.

1. 2026-02-26Disclosure

   disclosure

1. Reserviert2026-02-24
2. Veröffentlicht2026-02-26
3. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade terrajs-server to version 4.0.3 or later, which includes the corrected validation logic. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to unexpected or unauthorized domains. Carefully review and restrict the proxyableDomains configuration, ensuring it only includes absolutely necessary domains. Monitor access logs for suspicious proxy requests originating from unexpected domains. There are no specific Sigma or YARA rules readily available for this vulnerability, but custom rules can be developed based on observed malicious domain patterns.