hemmelig allows SSRF Filter bypass via Secret Request functionality

Description

A Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding (e.g., localtest.me which resolves to 127.0.0.1) or open redirect services (e.g., httpbin.org/redirect-to).

Recommendation

Update the hemmelig package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.3.3
• Patched version(s): 7.3.3

References

• GHSA-vvxf-wj5w-6gj5
• CVE-2025-69206
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior - CVE-2025-68458
• FUXA allows Remote Code Execution (RCE) via the project import functionality. - CVE-2025-69983
• qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - CVE-2025-15284
• Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format - CVE-2025-64430

Tags:

npm

hemmelig