Internet Bug Bounty · Report #2429894
Libuv: Improper Domain Lookup that potentially leads to SSRF attacks
Summary
Improper Domain Lookup that potentially leads to SSRF attacks
Summary The uv_getaddrinfo function in src/unix/getaddrinfo.c (and its windows counterpart src/win/getaddrinfo.c), truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to create addresses like 0x00007f000001, which are considered valid by getaddrinfo and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks.
Full GHSA: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6
How it was found
I recently encountered a challenge in a CTF competition that led me to discover a vulnerability within Node.js, present in all versions after v10. Upon further investigation and code debugging, it became apparent that the vulnerability originated from its direct dependency, libuv.
I submitted a report to the Node.js team via HackerOne, and they subsequently connected me with the libuv team. This collaboration resulted in the identification and resolution of the vulnerability, now recorded as CVE-2024-24806.
Impact
This vulnerability could allow an attacker to craft payloads that results in SSRF attacks and Internal API Access. Full explanation of vulnerability, PoC and sample scenarios are provided within the original report: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6