CVE-2025-8267
📋 TL;DR
The ssrfcheck package versions before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete IP address denylist that fails to block multicast addresses (224.0.0.0/4). This allows attackers to craft requests that bypass SSRF protections and target multicast networks. Any application using vulnerable versions of ssrfcheck for SSRF validation is affected.
💻 Affected Systems
- ssrfcheck
📦 What is this software?
Ssrf Check by Felipperegazio
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass SSRF protections entirely, potentially reaching internal services, cloud metadata endpoints, or other restricted resources that would normally be blocked.
Likely Case
Attackers can probe internal networks via multicast addresses, potentially discovering internal services or conducting network reconnaissance.
If Mitigated
With proper network segmentation and egress filtering, impact is limited to multicast network probing with minimal data exposure.
🎯 Exploit Status
Exploitation requires the application to process user-controlled URLs. The vulnerability is well-documented with public proof-of-concept available in the GitHub issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/felippe-regazio/ssrfcheck/commit/9507b49fd764f2a1a1d1e3b9ee577b7545e6950e
Restart Required: No
Instructions:
1. Update ssrfcheck to version 1.2.0 or later using npm: npm update ssrfcheck
2. Verify the update with: npm list ssrfcheck
3. Test SSRF validation with multicast addresses to confirm blocking.
🔧 Temporary Workarounds
Custom IP validation wrapper
allImplement additional validation to block multicast addresses (224.0.0.0/4) before passing URLs to ssrfcheck
🧯 If You Can't Patch
- Implement network egress filtering to block outbound traffic to multicast addresses (224.0.0.0/4)
- Use a web application firewall (WAF) with SSRF protection rules to block requests to multicast addresses
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list ssrfcheck | grep ssrfcheckCheck Version:
npm list ssrfcheck | grep ssrfcheckVerify Fix Applied:
Test SSRF validation with a multicast address (e.g., 224.0.0.1) - it should be rejected in version 1.2.0+📡 Detection & Monitoring
Log Indicators:
- Outbound HTTP requests to IP addresses in 224.0.0.0/4 range
- SSRF validation failures for multicast addresses
Network Indicators:
- Outbound traffic to multicast IP ranges from web servers
- Unusual destination IPs in 224.0.0.0/4
SIEM Query:
destination.ip IN (224.0.0.0/4) AND process.name CONTAINS 'node'