SSRF Bypass via IPv4 Validation in Fedify

Executive Summary

This vulnerability affects the Fedify TypeScript library, which is used to build federated server applications powered by ActivityPub. The issue lies in the IPv4 validation logic used to prevent Server-Side Request Forgery (SSRF) attacks by validating public URLs before fetching documents or media.

Although the library blocks common private and local IPv4 ranges such as 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, and 192.168.0.0/16, it incorrectly treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations.

Because the validation is incomplete, attackers can bypass the SSRF protections and potentially make requests to internal or otherwise restricted network addresses, which the library intended to block.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform SSRF attacks by bypassing the public URL validation in Fedify. This means an attacker could potentially make unauthorized requests to internal network resources or other restricted IP ranges.

The impact includes unauthorized access to internal services, information disclosure, and possibly limited denial of service or integrity issues, as indicated by the CVSS score which rates confidentiality impact as high, integrity as low, and availability as low.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update Fedify to one of the patched versions: 1.9.12, 1.10.11, 2.0.19, 2.1.15, or 2.2.4. These versions contain an updated patch that improves the IPv4 validation logic to better reject non-public IPv4 destinations and prevent SSRF bypass.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Fedify's incomplete SSRF mitigation allows attacker-controlled URLs to bypass protections and access internal or special-use network ranges. This can potentially expose internal services or sensitive data.

Such exposure risks could lead to unauthorized access or data breaches, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding sensitive information and internal systems.

Therefore, the vulnerability could negatively affect compliance by increasing the risk of unauthorized data access or leakage, which these standards aim to prevent.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an incomplete validation of public IPv4 addresses in the Fedify library, allowing SSRF attacks to bypass protections by targeting special-use IP ranges that are incorrectly treated as public.

To detect exploitation attempts on your network or system, you can monitor outbound requests made by the Fedify application to IP ranges that should be blocked but are currently allowed due to the flawed validation.

Specifically, look for outbound requests to special-use IPv4 ranges such as:

• 100.64.0.0/10 (Carrier-grade NAT)
• 198.18.0.0/15 (Benchmarking networks)
• 224.0.0.0/4 (Multicast)
• 240.0.0.0/4 (Reserved)

You can use network monitoring tools or firewall logs to identify such requests.

Example commands to detect such activity might include:

• Using tcpdump to capture outbound traffic to these IP ranges: tcpdump -n dst net 100.64.0.0/10 or dst net 198.18.0.0/15 or dst net 224.0.0.0/4 or dst net 240.0.0.0/4
• Using iptables to log outbound packets to these ranges: iptables -A OUTPUT -d 100.64.0.0/10 -j LOG --log-prefix "SSRF attempt: "
• Review application logs for any fetch or HTTP request calls to URLs resolving to these IP ranges.

Additionally, verifying the Fedify library version in use and ensuring it is updated to a patched version (>=1.9.12, 1.10.11, 2.0.19, 2.1.15, or 2.2.4) will help mitigate this vulnerability.

Useful 0 Not Useful 0