CVE-2024-39687: Server Side Request Forgery (SSRF) attack in Fedify
Summary
CVE-2024-39687: Server Side Request Forgery (SSRF) attack in Fedify. Affects @fedify/fedify across 3 version ranges.
< 0.9.2
>= 0.10.0, < 0.10.2
>= 0.11.0, < 0.11.2
Fixed in 0.9.2, 0.10.2 or 0.11.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fedify is an open-source package that facilitates the retrieval of objects and activities from remote ActivityPub servers. It is designed to make HTTP requests to the resources specified in the received activity. However, this behavior introduces a vulnerability where an attacker can manipulate the activity to reference internal IP addresses, potentially allowing unauthorized access to internal resources. This vulnerability is classified as a Server Side Request Forgery (SSRF) attack, which is a well-known security issue. The vulnerability affects versions 0.0.1 to 0.9.2 and 0.10.0 to 0.11.1 of the @fedify/fedify package.
Vulnerability Detail
The vulnerability arises from the lack of validation in the Fedify package when making HTTP requests to resources specified in activities or objects. This allows an attacker to craft activities that reference internal IP addresses, leading to unauthorized access to internal resources. The vulnerability also extends to media URLs. The impact of this vulnerability includes potential unauthorized access, exposure of non-public information, and the risk of further attacks through different protocols. The Deno-specific attack vector allows accessing the local filesystem, which may further exacerbate the impact. It is important to note that the ActivityPub specification also mentions this vulnerability, albeit in a more limited scope.
How To Fix
Latest published version: 2.4.4 as of 23 Oct 2026
npm install @fedify/fedify@2.4.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.9.20.9.2npm install @fedify/fedify@0.9.2 -
>= 0.10.0, < 0.10.20.10.2npm install @fedify/fedify@0.10.2 -
>= 0.11.0, < 0.11.20.11.2npm install @fedify/fedify@0.11.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, server operators can restrict access to non-public IP addresses. For instance, in Mastodon, requests to non-public IP addresses are allowed only for localhost in development and those specified in the ALLOWED_PRIVATE_ADDRESSES environment variable. However, implementing proper validation checks as described in the 'how_to_fix' section is the recommended long-term solution.
Conclusion
The Fedify package is vulnerable to a Server Side Request Forgery (SSRF) attack, allowing unauthorized access to internal resources. This vulnerability can be mitigated by implementing proper validation checks on the URIs before making HTTP requests. Server operators can also apply temporary workarounds to restrict access to non-public IP addresses. It is crucial to address this vulnerability promptly to prevent unauthorized access and potential exposure of sensitive information.
See every vulnerability recorded for @fedify/fedify →
FAQ
Fedify is an open-source package that facilitates the retrieval of objects and activities from remote ActivityPub servers.
A Server Side Request Forgery (SSRF) attack is a security vulnerability where an attacker can manipulate a server to make unintended requests to internal resources.
The vulnerability allows unauthorized access to internal resources, potential exposure of non-public information, and the risk of further attacks through different protocols.
To fix this vulnerability, the Fedify package should implement validation checks on the URIs before making HTTP requests. The validation should ensure that the URIs resolve to public IP addresses and adhere to either HTTPS or HTTP protocols.
As a temporary workaround, server operators can restrict access to non-public IP addresses. However, implementing proper validation checks is the recommended long-term solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fedify/fedify.
