CyberRota Analysis
AI-GeneratedThe DSSRF Node.js library prior to version 1.0.4 contains a vulnerability in the is_url_safe function that improperly handles the @ userinfo delimiter, enabling attackers to bypass internal IP validation. This flaw could allow malicious URLs to direct clients to internal services, potentially leading to unauthorized access or data exposure. Organizations using this library should prioritize updating to version 1.0.4 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.