CVE-2024-39687

July 5, 2024, 6:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Fedify

  • 0.9.2
  • 0.10.1
  • 0.11.1

Source

security-advisories@github.com

Tags

CVE-2024-39687 details

Published : July 5, 2024, 6:15 p.m.
Last Modified : July 5, 2024, 6:15 p.m.

Description

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue.

CVSS Score

1 2 3 4 5 6 7.2 8 9 10

Weakness

Weakness Name Description
CWE-918 Server-Side Request Forgery (SSRF) The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

Base Score

7.2

Exploitability Score

3.9

Impact Score

2.7

Base Severity

HIGH

This website uses the NVD API, but is not approved or certified by it.