CVE-2025-54590

CVSS

No CVSS.

w

ebfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing access to localhost services in production. This library does not prevent localhost access, only checking for hosts that start with "localhost" and end with a port. Users can exploit this by creating servers that send GET requests with controlled host, path, and port parameters to query services on the instance's host or local network, enabling blind SSRF attacks. This is fixed in version 2.8.1.

References

Link	Resource
https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a
https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1
https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv

Configurations

No configuration.

History

04 Aug 2025, 15:06

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-01 18:15

Updated : 2025-08-04 15:06

NVD link : CVE-2025-54590

Mitre link : CVE-2025-54590

CVE.ORG link : CVE-2025-54590

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-54590", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-01T18:15:55.577", "references": [{"url": "https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a", "source": "[email protected]"}, {"url": "https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1", "source": "[email protected]"}, {"url": "https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing access to localhost services in production. This library does not prevent localhost access, only checking for hosts that start with \"localhost\" and end with a port. Users can exploit this by creating servers that send GET requests with controlled host, path, and port parameters to query services on the instance's host or local network, enabling blind SSRF attacks. This is fixed in version 2.8.1."}, {"lang": "es", "value": "webfinger.js es un cliente WebFinger basado en TypeScript que funciona tanto en navegadores como en entornos Node.js. En las versiones 2.8.0 y anteriores, la funci\u00f3n de b\u00fasqueda acepta direcciones de usuario para la comprobaci\u00f3n de cuentas. Sin embargo, la especificaci\u00f3n ActivityPub exige impedir el acceso a los servicios del host local en producci\u00f3n. Esta librer\u00eda no impide el acceso al host local, sino que solo comprueba los hosts que empiezan por \"localhost\" y terminan con un puerto. Los usuarios pueden aprovechar esto creando servidores que env\u00eden solicitudes GET con par\u00e1metros de host, ruta y puerto controlados para consultar servicios en el host o la red local de la instancia, lo que permite ataques SSRF ciegos. Esto se ha corregido en la versi\u00f3n 2.8.1."}], "lastModified": "2025-08-04T15:06:15.833", "sourceIdentifier": "[email protected]"}