CVE-2024-41813: SSRF in txtdot Node.js Proxy

The SSRF vulnerability in txtdot allows an attacker to bypass network security controls and access internal resources that are not directly accessible from the outside world. An attacker could, for example, scan internal ports, access internal APIs, or retrieve sensitive data from internal databases or file servers. The blast radius extends to any internal service accessible via HTTP GET requests. Successful exploitation could lead to data breaches, unauthorized access to internal systems, and potentially, further compromise of the network. The ability to proxy requests through txtdot effectively grants the attacker a foothold within the internal network.

1. Reserved2024-07-22
2. Published2024-07-26
3. Modified2024-08-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-41813 is to upgrade to version 1.6.1 of txtdot. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict network access to the txtdot server to only trusted sources using firewall rules or network segmentation. Implement input validation on the /proxy route to prevent attackers from specifying arbitrary target URLs. Monitor txtdot logs for suspicious outbound requests. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter malicious requests. After upgrading, confirm the fix by attempting to send a request to an internal resource through the /proxy route; the request should be blocked.