Medium, CVSS 4.3npmAmendedPublished
hemmelig allows SSRF Filter bypass via Secret Request functionality
CVE-2025-69206 · GHSA-vvxf-wj5w-6gj5
- Affected
- npm hemmelig < 7.3.3
- Fixed in
- 7.3.3· Vendor fix available
- Issue
- A Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding (e.g., localtest.me which resolves to 127.0.0.1) or open redirect services (e.g., httpbin.org/redirect-to). This allows an authenticated user to make the server initiate HTTP requests to internal network resources. Details The vulnerability exists in the isPublicUrl function located in /api/lib/utils.ts. The function validates webhook URLs against a blocklist of private IP patterns: The validation is flawed because: 1. DNS Rebinding Bypass: It only checks the hostname string, not the resolved IP address. Domains like localtest.me pass validation (not matching any blocked pattern) but resolve to 127.0.0.1. 2. Open Redirect Bypass: External URLs like httpbin.org/redirect-to?url=http://127.0.0.1 pass validation since httpbin.org is a public…
Recommended action: Upgrade to 7.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.