dahlia fedify 0.9.1/0.10.0/0.11.0 server-side request forgery

Summaryinfo

A vulnerability was found in dahlia fedify 0.9.1/0.10.0/0.11.0. It has been rated as critical. Affected by this issue is some unknown functionality. This manipulation causes server-side request forgery. This vulnerability appears as CVE-2024-39687. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in dahlia fedify 0.9.1/0.10.0/0.11.0. It has been declared as critical. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-39687 since 06/27/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.9.2, 0.10.1 or 0.11.1 eliminates this vulnerability. Applying the patch 30f9cf4a175704a04c874f3ea88414c5f1e00b28 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• dahlia

Name

• fedify

Version

• 0.9.1
• 0.10.0
• 0.11.0

License

• open-source

Website

• Product: https://github.com/dahlia/fedify/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion