CVE-2025-2691
📋 TL;DR
This SSRF vulnerability in nossrf versions before 1.0.4 allows attackers to bypass protection mechanisms by providing hostnames that resolve to local or reserved IP addresses. This could enable internal network probing, service enumeration, or data exfiltration. Any application using vulnerable nossrf versions for SSRF protection is affected.
💻 Affected Systems
- nossrf
📦 What is this software?
Nossrf by Nossrf Project
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains access to internal services, exfiltrates sensitive data, or performs lateral movement within the network.
Likely Case
Internal service enumeration, metadata harvesting from cloud services, or limited data exposure from internal APIs.
If Mitigated
Limited to failed connection attempts or minimal information disclosure if proper network segmentation and egress filtering are in place.
🎯 Exploit Status
Exploitation requires ability to control input that gets passed to nossrf validation functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4
Vendor Advisory: https://security.snyk.io/vuln/SNYK-JS-NOSSRF-9510842
Restart Required: No
Instructions:
1. Update package.json to specify 'nossrf': '^1.0.4'. 2. Run 'npm update nossrf'. 3. Test application functionality.
🔧 Temporary Workarounds
Input validation enhancement
allImplement additional validation of hostnames before passing to nossrf
🧯 If You Can't Patch
- Implement network-level egress filtering to restrict outbound connections from application servers
- Deploy WAF rules to detect and block SSRF patterns in HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for nossrf version <1.0.4Check Version:
npm list nossrfVerify Fix Applied:
Verify package.json specifies nossrf version >=1.0.4 and run 'npm list nossrf'📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from application servers
- Requests to internal IP addresses or localhost
Network Indicators:
- Outbound connections to internal services from application servers
- DNS queries for internal hostnames
SIEM Query:
source='application_logs' AND (url CONTAINS 'localhost' OR url CONTAINS '127.0.0.1' OR url CONTAINS 'internal' OR url CONTAINS 'metadata')