CVE-2025-69206: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69206 is a Server-Side Request Forgery (SSRF) filter bypass vulnerability in Hemmelig, an open-source messaging application with client-side encryption and self-destructing messages. The flaw exists in the webhook URL validation of the Secret Requests feature, where the application's blocklist-based SSRF protection can be circumvented via DNS rebinding or open redirect techniques. All versions prior to 7.3.3 of the hemmelig npm package are affected. The vulnerability was published on December 28–29, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Github Advisory, Security Advisory).

The root cause (CWE-918) lies in the isPublicUrl function in /api/lib/utils.ts, which validates webhook URLs by checking the hostname string against a regex blocklist of private IP patterns — without ever resolving the hostname to its actual IP address. Two bypass techniques are documented: (1) DNS rebinding — domains like localtest.me pass the hostname check but resolve to 127.0.0.1 at request time; (2) open redirect — URLs such as httpbin.org/redirect-to?url=http://127.0.0.1:PORT pass validation because httpbin.org is a public domain, but the server follows the redirect to the internal address. Exploitation requires a low-privilege authenticated account and no user interaction beyond submitting a crafted webhook URL in the Secret Requests feature (Security Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to cause the Hemmelig server to initiate HTTP requests to internal network resources that should not be reachable from the public internet. The impact is limited to a blind SSRF — no response body is reflected to the attacker — but response-timing techniques can be used to enumerate open ports on internal hosts. This could expose sensitive internal services (e.g., metadata endpoints, internal APIs) to information disclosure, with no integrity or availability impact (Github Advisory, Security Advisory).

A proof-of-concept is publicly documented in the GitHub security advisory, demonstrating both the DNS rebinding and open redirect bypass techniques. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.015% (1st percentile), indicating a very low probability of near-term exploitation (Github Advisory, Security Advisory).

1. Authenticate: Log in to a Hemmelig instance running a version prior to 7.3.3 with any valid user account.
2. Navigate to Secret Requests: Switch to the Secret Requests tab in the application UI and create a new secret request.
3. Craft a bypass payload: In the Webhook URL field, enter one of the following:
   • DNS rebinding: http://localtest.me:PORT (resolves to 127.0.0.1 at request time)
   • Open redirect: http://httpbin.org/redirect-to?url=http://127.0.0.1:PORT (server follows redirect to internal address)
4. Trigger the webhook: Open a new browser tab and confirm the secret request by creating a secret. Upon saving, the Hemmelig server will issue an HTTP POST to the crafted URL, reaching the internal target.
5. Enumerate internal services: Use response-timing differences (connection refused vs. timeout) to determine whether a given internal port is open, enabling blind port scanning of the internal network (Security Advisory).

• Logs: Application logs containing entries such as Secret request webhook delivery failed after retries: TypeError: fetch failed with cause: Error: connect ECONNREFUSED 127.0.0.1:<PORT> — indicating attempted connections to internal addresses via webhook delivery.
• Network: Outbound HTTP requests from the Hemmelig server to domains like localtest.me, httpbin.org, or other redirect/rebinding services originating from the webhook delivery process; subsequent connections to internal RFC-1918 or loopback addresses.
• Logs: Webhook delivery log entries referencing unusual or unexpected internal IP addresses (e.g., 127.x.x.x, 10.x.x.x, 192.168.x.x) in error stack traces from /app/api/routes/secret-requests.ts (Security Advisory).

Upgrade Hemmelig to version 7.3.3 or later, which replaces hostname-string validation with DNS resolution-based checking (resolving hostnames to IPs before comparing against private ranges) and disables redirect following in webhook fetch calls (redirect: 'error'). As interim mitigations: restrict webhook functionality to trusted users only, implement network segmentation to prevent the Hemmelig server from reaching internal resources, and monitor outbound HTTP requests from the server for anomalous destinations. Review and remove any suspicious webhook URLs already configured (Security Advisory, Patch Commit).

The vulnerability was reported by security researcher Alakinnn and patched promptly by the Hemmelig maintainer (bjarneo) on December 28, 2025. Coverage has been limited to automated vulnerability tracking platforms and a small number of security news aggregators, consistent with the moderate severity rating and niche user base of the affected application (Security Advisory).