GHSA-5846-7qm3-r52j
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery.
## POC
Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf:
```js
import { is_url_safe } from '../dist/helpers.js';
import dns from 'dns';
dns.setServers(['1.1.1.1']);
const TARGET = 'http://localhost/admin';
console.log(`Testing: ${TARGET}`);
console.log(`Current DNS Servers: ${dns.getServers()}`);
const result = await is_url_safe(TARGET);
if (result === true) {
console.log('dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.');
} else {
console.log('dssrf blocked localhost.');
}
```
References
External links from the advisory. They lead to third-party sites.