CyberRota Analysis
AI-GeneratedThe Fedify TypeScript library, specifically versions 1.2.0 through 2.3, is vulnerable due to the getNodeInfo() function improperly handling attacker-controlled links, which can lead to unauthorized access to sensitive internal services and data. This high-severity vulnerability (CVSS 8.8) poses a significant risk to applications utilizing Fedify for federated server architecture, particularly those handling sensitive information. Developers and organizations using affected versions should prioritize upgrading to the patched versions to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.