nossrf Server-Side Request Forgery (SSRF)

The SSRF vulnerability in nossrf allows an attacker to craft requests that appear to originate from the server itself, bypassing security controls designed to prevent access to internal services. By providing a hostname that resolves to a local or reserved IP address, an attacker can circumvent the SSRF protection and potentially access sensitive data or internal systems. This could include accessing databases, configuration files, or other internal APIs. The impact is amplified if the server is exposed to the internet or if the attacker can leverage the vulnerability to pivot to other internal systems, leading to a broader compromise.

Applications utilizing the nossrf Node.js package, particularly those deployed in environments with internal services accessible via HTTP or HTTPS, are at risk. Shared hosting environments where users have the ability to install and manage their own Node.js packages are also particularly vulnerable.

• nodejs / server:

  npm list nossrf

If the output shows a version less than 1.0.4, the system is vulnerable. • nodejs / server:

  npm audit nossrf

This command will identify the vulnerability and suggest an upgrade. • generic web: Review application logs for unusual outbound requests to local or reserved IP addresses. Look for patterns that suggest an attacker is attempting to bypass SSRF protection.

1. 2025-03-23Disclosure

   disclosure

1. Reservado2025-03-23
2. Publicada2025-03-23
3. Modificada2025-09-26
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-2691 is to immediately upgrade the nossrf package to version 1.0.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter requests based on hostname resolution. Specifically, block requests where the hostname resolves to local or reserved IP address ranges. Additionally, review and restrict the allowed hostnames within your application's code to minimize the attack surface. After upgrading, confirm the fix by attempting to trigger an SSRF request with a local IP address; the request should be blocked.