CVE-2025-69206: hemmelig SSRF Filter Bypass via Secret Request Functionality
Summary
CVE-2025-69206: hemmelig allows SSRF Filter bypass via Secret Request functionality. Affects hemmelig versions < 7.3.3. Fixed in 7.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
hemmelig is an open-source application designed to facilitate secure communication through secret requests. It allows users to send sensitive information securely by utilizing webhook URLs for notifications. However, the application has a vulnerability in its webhook URL validation process, which can be exploited to perform Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
A Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding (e.g., localtest.me which resolves to 127.0.0.1) or open redirect services (e.g., httpbin.org/redirect-to). This allows an authenticated user to make the server initiate HTTP requests to internal network resources. The flaw lies in the isPublicUrl function, which only checks the hostname string against a blocklist of private IP patterns, failing to validate the resolved IP address.
How To Fix
Minimum fixed version
7.3.3
This is the first release that contains the fix.
npm install hemmelig@7.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the webhook functionality until the package is updated. Additionally, avoid using DNS rebinding domains or open redirect services in webhook URLs.
Conclusion
The hemmelig package has a vulnerability that allows SSRF filter bypass through its Secret Requests feature. By updating to version 7.3.3 or later, users can mitigate this risk. It is crucial to monitor for such vulnerabilities and apply patches promptly to maintain application security.
See every vulnerability recorded for hemmelig →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests from a vulnerable server to internal or external resources.
An authenticated user can exploit this vulnerability by crafting a malicious webhook URL that uses DNS rebinding or open redirect services to access internal network resources.
The practical impact is limited to Blind SSRF, meaning the attacker cannot see the response. However, they can use techniques like response-timing to infer whether a port is open.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
