CVE-2022-25876 Server-side Request Forgery (SSRF)
Attackers can exploit flawed DNS rebinding protection to send arbitrary requests to the local network and read responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25876?
CVE-2022-25876 is a medium-severity server-side request forgery vulnerability in link-preview-js, published on 1 Jul 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
Weakness: CWE-918
Which versions are affected by CVE-2022-25876?
2 open source packages ship an affected version, including link-preview-js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
link-preview-js npm | All versions | 2.1.17 |
link-preview-js npm | All versions | 2.1.17 |
Products include Link-Preview-Js Project Link-Preview-Js.
How do I fix CVE-2022-25876?
Upgrade link-preview-js to 2.1.17 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-25876 being exploited?
There is no known exploitation of CVE-2022-25876 in the wild and no public exploit code.
Sources
Also known as GHSA-h9cw-7g8j-h66h.