CVE-2022-25876: Server-Side Request Forgery in link-preview-js
Summary
CVE-2022-25876: Server-Side Request Forgery in link-preview-js. Affects link-preview-js versions < 2.1.17. Fixed in 2.1.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
link-preview-js is an npm package that provides functionality for generating link previews. It allows users to extract metadata from URLs and display a preview of the linked content. The package is widely used in web applications to enhance the user experience by providing a visual representation of external links. However, versions before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF), which can lead to unauthorized access to internal resources and potential data leakage.
Vulnerability Detail
The vulnerability in link-preview-js arises from flawed DNS rebinding protection. Attackers can exploit this vulnerability to send arbitrary requests to the local network and read the response. By crafting malicious URLs, an attacker can trick the application into making requests to internal resources that should not be accessible from the outside. This can lead to unauthorized access to sensitive information or even compromise the entire network if the targeted internal resource is vulnerable. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.5.
How To Fix
Minimum fixed version
2.1.17
This is the first release that contains the fix.
npm install link-preview-js@2.1.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of link-preview-js to mitigate the risk of SSRF attacks.
Conclusion
link-preview-js versions before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF), which can lead to unauthorized access to internal resources and potential data leakage. To mitigate this vulnerability, it is recommended to upgrade to version 2.1.17 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for link-preview-js →
FAQ
link-preview-js is an npm package that provides functionality for generating link previews. It allows users to extract metadata from URLs and display a preview of the linked content.
Server-side Request Forgery (SSRF) is a vulnerability that allows an attacker to make arbitrary requests from the server to internal resources. In the case of link-preview-js, it can be exploited to access sensitive information or compromise the network.
The potential consequences of this vulnerability include unauthorized access to internal resources, data leakage, and potential compromise of the entire network if the targeted internal resource is vulnerable.
To fix this vulnerability, you should upgrade to version 2.1.17 or later of link-preview-js. This version includes a fix for the flawed DNS rebinding protection.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of link-preview-js to mitigate the risk of SSRF attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for link-preview-js.
