CVE-2025-67427: 
JavaScript vulnerability analysis and mitigation

CVE-2025-67427 is a Blind Server-Side Request Forgery (SSRF) vulnerability in EverShop, a TypeScript-based open-source e-commerce platform for Node.js. It affects all versions up to and including 2.1.0 and allows unauthenticated attackers to force the server to initiate arbitrary HTTP or HTTPS requests via the GET /images API endpoint by supplying unsanitized URIs in the src query parameter. The vulnerability was published on January 5, 2026, with a CVSS v3.1 base score of 6.5 (Medium) as assessed by CISA-ADP (Github Advisory, NVD).

The root cause is insufficient input validation on the src query parameter of the GET /images API endpoint, classified as CWE-918 (Server-Side Request Forgery). Because the application accepts arbitrary HTTP or HTTPS URIs without allowlist enforcement or internal network range filtering, an unauthenticated attacker can craft a request such as GET /images?src=http://169.254.169.254/latest/meta-data/ to cause the server to fetch resources from internal or external hosts. No authentication or special privileges are required, and exploitation requires only network access to the exposed API. A third-party advisory and technical write-up are publicly available (dos-m0nk3y CVE Repo, Github Advisory).

Successful exploitation enables an attacker to use the EverShop server as a proxy to reach internal network services that would otherwise be inaccessible, including cloud metadata endpoints, internal APIs, and administrative interfaces. This creates risks of internal network reconnaissance, sensitive data exfiltration (e.g., cloud credentials via metadata services), and unauthorized interaction with backend systems. The CVSS assessment reflects low confidentiality and low integrity impact with no availability impact, though chained with other vulnerabilities the blast radius could be significantly larger (Github Advisory, NVD).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.027% (0.000270), placing it in a low exploitation probability tier. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing EverShop instances running version 2.1.0 or earlier using search engines (Shodan, Censys) or by inspecting HTTP response headers and application footprints.
2. Identify the vulnerable endpoint: Confirm the GET /images API is accessible without authentication by sending a benign request such as GET /images?src=https://example.com/test.jpg.
3. Probe internal network: Craft requests targeting internal resources, for example:

   GET /images?src=http://169.254.169.254/latest/meta-data/
   GET /images?src=http://192.168.1.1/admin

4. Enumerate internal services: Iterate over common internal IP ranges and ports to map accessible services, using timing differences or error responses to infer open ports (blind SSRF technique).
5. Exfiltrate data: If the server reflects any response content, extract sensitive information such as cloud instance metadata, IAM credentials, or internal API responses (dos-m0nk3y CVE Repo, Github Advisory).

• Network: Outbound HTTP/HTTPS requests from the EverShop server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); unusual outbound connections to external hosts not related to normal e-commerce operations.
• Logs: Web server access logs showing repeated GET /images requests with src parameters containing internal IP addresses, localhost, 127.0.0.1, or cloud metadata URLs; high volume of requests to the /images endpoint from a single source IP.
• Application Logs: Node.js application logs recording HTTP fetch errors or timeouts for internal/non-image URIs passed via the src parameter.

The GitHub Advisory notes that no patched version was listed as of January 5, 2026; however, the EverShop repository shows releases beyond v2.1.0 (latest v2.1.2 as of April 2026), and users should upgrade to the latest available version (EverShop GitHub, Github Advisory). As interim mitigations: implement strict allowlist validation on the src query parameter to permit only trusted external domains; deploy outbound firewall rules to block the server from initiating connections to internal network ranges and cloud metadata endpoints; and apply network segmentation to limit the server's lateral reach. Applying the principle of least privilege to the server's network access permissions further reduces risk.

A technical blog post was published by the researcher (dos-m0nk3y) covering this and related EverShop vulnerabilities, available at https://pages.dos-m0nk3y.com/blog/EverShop%202.1.0%20-%20Unauthenticated%20DoS/ (Github Advisory). No significant vendor statements, broader media coverage, or notable community discussion beyond the advisory and researcher disclosure have been identified.