PT-2025-20008 · Npm · @Misskey-Dev/Summaly
Published
2025-05-06
·
Updated
2025-05-06
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Summary
Due to a validation error in
got.scpaping, it is possible to use an HTTP redirect to avoid IP filtering.Details
In
got.scpaping, Summaly first makes a HTTP HEAD request to the page being summarized. It then preforms private IP address checks on the HEAD response, then makes an additional HTTP GET request to the page being summarized. Unfortunately, since private IP address checks aren't performed on the GET response, the GET response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.PoC
With a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:
caddy
@summaly-bypass-head {
method HEAD
path /summaly-bypass
}
@summaly-bypass-get {
method GET
path /summaly-bypass
}
header @summaly-bypass-head Content-Type "text/html"
respond @summaly-bypass-head 200
redir @summaly-bypass-get http://127.0.0.1:3080/Impact
Using this bypass, an attacker can probe a victims internal network for HTTP services that aren't supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.
Fix
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Misskey-Dev/Summaly