Fix SSRF via DNS Rebinding in Node.js fetch dispatcher

Vulnerability Overview This vulnerability involves strengthening SSRF (Server-Side Request Forgery) protections, specifically against DNS rebinding attacks. The fix enables the system to better prevent malicious users from bypassing security restrictions using DNS rebinding techniques. Scope of Impact Affected File: Affected Function: function and its related logic Remediation 1. Enhanced DNS Rebinding Protection: - Added detection and handling logic for DNS rebinding within the function. - Utilizes the list to block requests to specific IP addresses. 2. Code Changes: - In the file, a list was added, containing multiple blocked IP address ranges. - The function was modified to include DNS rebinding detection logic. POC Code The following is the key code snippet after the fix: ```typescript const BLOCKED_ADDRESSES = new BlockList(); BLOCKED_ADDRESSES.addSubnet("0.0.0.0", 8, "ipv4"); BLOCKED_ADDRESSES.addSubnet("10.0.0.0", 8, "ipv4"); BLOCKED_ADDRESSES.addSubnet("100.64.0.0", 10, "ipv4"); BLOCKED_ADDRESSES.addSubnet("127.0.0.0", 8, "ipv4"); BLOCKED_ADDRESSES.addSubnet("169.254.0.0", 16, "ipv4"); BLOCKED_ADDRESSES.addSubnet("172.16.0.0", 12, "ipv4"); BLOCKED_ADDRESSES.addSubnet("192.0.2.0", 24, "ipv4"); BLOCKED_ADDRESSES.addSubnet("192.168.0.0", 16, "ipv4"); BLOCKED_ADDRESSES.addSubnet("198.51.100.0", 24, "ipv4"); BLOCKED_ADDRESSES.addSubnet("203.0.113.0", 24, "ipv4"); BLOCKED_ADDRESSES.addSubnet("224.0.0.0", 4, "ipv4"); BLOCKED_ADDRESSES.addSubnet("240.0.0.0", 4, "ipv4"); BLOCKED_ADDRESSES.addAddress("::", "ipv6"); BLOCKED_ADDRESSES.addAddress("::1", "ipv6"); BLOCKED_ADDRESSES.addSubnet("fc00::", 7, "ipv6"); BLOCKED_ADDRESSES.addSubnet("fe80::", 10, "ipv6"); function getLinePreview(fetchOptions: RequestInit, dispatcher?: Dispatcher): FetchOptions { if (!dispatcher) { return fetchOptions; } return { ...fetchOptions, dispatcher, }; } async function destroyDispatchers(dispatchers: Dispatcher[]) { await Promise.all( dispatchers.map(async (dispatcher) => { const disposableDispatcher = dispatcher as Dispatcher & { close?: () => Promise; destroy?: () => Promise; }; try { await disposableDispatcher.close?.(); await disposableDispatcher.destroy?.(); } catch (error) { // Ignore errors } }) ); } async function getLinePreview(url: string, options?: GetLinePreviewOptions): Promise { const { onAbort, onProgress, onRedirect, onResponse, resolveDNSHost, ...fetchOptions } = options const expectedHostname = normalizeHostname(url); const dispatcher = createDispatcher(url, resolveDNSHost); const fetchOptionsWithDispatcher = getLinePreview(fetchOptions, dispatcher); const response = await fetch(url, fetchOptionsWithDispatcher); if (onResponse) { await onResponse(response); } const text = await response.text(); const cheerio = load(text); const lines = cheerio("body").text().split("\n"); const line = lines[0] return { title: cheerio("title").text(), description: cheerio("meta[name='description']").attr("content") line, }; } function createDispatcher(url: string, resolveDNSHost?: string): Dispatcher { if (resolveDNSHost) { return new Agent({ connect: { lookup: (hostname: string, options: any, callback: (err: Error if (normalizeHostname(hostname) !== expectedHostname) { callback(new Error("SSRF request detected, hostname changed after DNS validation"), null, 0); return; } if (lookupOptions?.all) { callback(null, [address, family]); return; } callback(null, address, family); }, }, }); } return new Agent({ connect: { lookup: (hostname: string, options: any, callback: (err: Error if (normalizeHostname(hostname) !== expectedHostname) { callback(new Error("SSRF request detected, hostname changed after DNS validation"), null, 0); return; } if (lookupOptions?.all) { callback(null, [address, family]); return; } callback(null, address, family); }, }, }); } function normalizeHostname(hostname: string): string { return hostname.toLowerCase().replace(/\.+$/, ""); } function createDispatcher(url: string, resolveDNSHost?: string): Dispatcher { if (resolveDNSHost) { return new Agent({ connect: { lookup: (hostname: string, options: any, callback: (err: Error if (normalizeHostname(hostname) !== expectedHostname) { callback(new Error("SSRF request detected, hostname changed after DNS validation"), null, 0); return; } if (lookupOptions?.all) { callback(null, [address, family]); return; } callback(null, address, family); }, }, }); } return new Agent({ connect: { lookup: (hostname: string, options: any, callback: (err: Error if (normalizeHostname(hostname) !== expectedHostname) { callback(new Error("SSRF request detected, hostname changed after DNS validation"), null, 0); return; } if (lookupOptions?.all) { callback(null, [address, family]); return; } callback(null, address, family); }, }, }); } function normalizeHostname(hostname: string): string { return hostname.toLowerCase().replace(/\.+$/, ""); } function createDispatcher(url: string, resolveDNSHost?: string): Dispatcher { if (resolveDNSHost) { return new Agent({ connect: { lookup: (hostname: strin

Goal Reached Thanks to every supporter — we hit 100%!

Fix SSRF via DNS Rebinding in Node.js fetch dispatcher

More from this source