प्लेटफ़ॉर्म
nodejs
घटक
typebot.io
में ठीक किया गया
3.13.2
A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in Typebot, an open-source chatbot builder. This flaw, present in versions prior to 3.13.1, allows authenticated users to make arbitrary HTTP requests from the server. Exploitation can lead to the extraction of AWS IAM credentials, potentially resulting in complete compromise of Kubernetes clusters and associated AWS infrastructure. Typebot version 3.13.1 addresses this vulnerability.
The SSRF vulnerability in Typebot's HTTP Request component allows attackers to bypass IMDSv2 protection and access the AWS Instance Metadata Service (IMDS). By injecting custom headers, an attacker can retrieve temporary AWS IAM credentials associated with the EKS node role. These credentials grant significant privileges, enabling attackers to assume the role and gain full control over the Kubernetes cluster. This includes the ability to deploy malicious workloads, steal sensitive data, and potentially pivot to other AWS resources. The potential blast radius extends beyond the Typebot instance itself, encompassing the entire Kubernetes environment and associated AWS infrastructure.
This vulnerability is considered high probability due to the ease of exploitation and the potential for significant impact. Public proof-of-concept code is likely to emerge given the SSRF nature of the vulnerability. The vulnerability was publicly disclosed on 2025-11-13. It is recommended to monitor CISA KEV for potential inclusion.
Organizations deploying Typebot within Kubernetes environments, particularly those utilizing AWS EKS and relying on IAM roles for node authentication, are at significant risk. Shared hosting environments running Typebot are also vulnerable, as the SSRF could potentially be leveraged to access resources outside the intended scope.
• linux / server:
journalctl -u typebot -g "HTTP Request"• generic web:
curl -I <typebot_instance_url>/webhook/request | grep -i "x-aws-ec2-metadata"disclosure
एक्सप्लॉइट स्थिति
EPSS
0.06% (18% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-64709 is to upgrade Typebot to version 3.13.1 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict outbound network access from the Typebot instance to only necessary destinations. Implement strict input validation on the HTTP Request component to prevent malicious header injection. Monitor Typebot logs for suspicious outbound requests, particularly those targeting the AWS Instance Metadata Service. After upgrading, confirm the fix by attempting to access the IMDS through the HTTP Request component and verifying that access is denied.
Actualice Typebot a la versión 3.13.1 o superior. Esta versión corrige la vulnerabilidad SSRF en el bloque de webhook. La actualización evitará la posible extracción de credenciales de AWS EKS y el compromiso del clúster de Kubernetes.
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-64709 is a critical SSRF vulnerability in Typebot versions up to 3.13.0, allowing attackers to extract AWS IAM credentials and compromise Kubernetes clusters.
You are affected if you are running Typebot version 3.13.0 or earlier. Upgrade to 3.13.1 to resolve the vulnerability.
Upgrade Typebot to version 3.13.1. As a temporary workaround, restrict outbound network access and implement strict input validation.
While no active exploitation has been confirmed, the ease of exploitation suggests it is likely to be targeted. Monitor your systems and apply the patch promptly.
Refer to the Typebot project's official release notes and security advisories on their GitHub repository for the latest information.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।