CVE-2024-39687: 
JavaScript vulnerability analysis and mitigation

Fedify, a TypeScript library for building federated server apps powered by ActivityPub, was found to contain a Server Side Request Forgery (SSRF) vulnerability (CVE-2024-39687). The vulnerability was discovered in versions prior to 0.9.2, 0.10.1, and 0.11.1, where the library's document loader component would make HTTP requests to @id or other resources from remote ActivityPub servers without properly validating the URLs, potentially allowing attackers to access internal network resources (GitHub Advisory).

The vulnerability exists in the DocLoader component where the fetch API does not validate URIs to ensure they resolve to public IP addresses. When Fedify needs to retrieve an object or activity, it makes HTTP requests to the @id or other resources present within received activities. The vulnerability is rated as HIGH severity with a CVSS v3.1 score of 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L). The issue is classified as CWE-918 (Server-Side Request Forgery) (GitHub Advisory, NVD).

The vulnerability could allow attackers to send requests to resources internal to the Fedify server's network. This impacts server operators as resources internal to their network may be improperly accessed or potentially exposed to the public. Additionally, downstream software using Fedify that fetches data from URIs contained within Activities or Objects may be at risk of requesting and storing non-public resources (GitHub Advisory).

The vulnerability can be exploited by referencing an @id that points to an internal IP address. The attack vector is network-based, requires low complexity, needs no privileges or user interaction, and can affect resources beyond its security scope. The vulnerability applies to both document resolution containing activities/objects and media URLs (GitHub Advisory).

Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 or later to receive the patch for this issue. The fix includes implementation of URL validation to prevent SSRF attacks by ensuring requests are only made to public IP addresses and proper HTTP/HTTPS protocols (FortiGuard, GitHub Advisory).