PT-2025-31675 · Unknown · Webfinger.Js

Ori Hollander + 1 · Publicado 2025-07-28 · Atualizado 2025-08-01 · CVE-2025-54590

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions webfinger.js versions 2.8.0 and below

Description webfinger.js is a TypeScript-based WebFinger client used in browser and Node.js environments. The lookup function does not prevent access to localhost services, only checking for hosts that start with "localhost" and end with a port. This allows attackers to perform blind Server-Side Request Forgery (SSRF) attacks by sending GET requests with controlled host, path, and port parameters to query services on the instance's host or local network.

Recommendations Update to version 2.8.1 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2025-54590

GHSA-8XQ3-W9FX-74RV

Produtos afetados

Webfinger.Js

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54590.json · Exploit
• https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv · Nota
• https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1 · Nota
• https://github.com/silverbucket/webfinger.js · Nota
• https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a · Nota
• https://twitter.com/CVEnew/status/1951355936972382391 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-54590 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8xq3-w9fx-74rv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-54590 · Nota de Segurança