GHSA-jqx4-9gpq-rppm: @misskey dev/summaly @misskey-dev/summaly Allows IP Filter Bypass Vulnerability

MODERATE
Share
CVSS 5.3
CWE-346
Published
Advisory Summary

GHSA-jqx4-9gpq-rppm is a MODERATE (CVSS 5.3) @misskey-dev/summaly allows ip filter bypass vulnerability (CWE-346: Origin Validation Error) affecting @misskey dev/summaly libraries in the npm ecosystem. The issue involves @misskey-dev/summaly allows ip filter bypass via redirect. Remediation is available by upgrading affected packages to version 5.2.1.

GHSA-jqx4-9gpq-rppm at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-jqx4-9gpq-rppm
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-346: Origin Validation Error
Affected Product @misskey dev/summaly
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix GHSA-jqx4-9gpq-rppm

To remediate this vulnerability, upgrade all affected @misskey dev/summaly dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@misskey-dev/summaly fixed: 5.2.1 
npm install @misskey-dev/summaly@5.2.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @misskey-dev/summaly

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-jqx4-9gpq-rppm, inspect your project dependencies using npm:

npm ls @misskey-dev/summaly

Analyze the terminal output to locate any version of @misskey dev/summaly in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.2.1), your application is affected.

Note: The npm ls @misskey-dev/summaly command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-346: Origin Validation Error, where the product does not properly verify that the source of data or communication is valid. In @misskey dev/summaly, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Due to a validation error in `got.scpaping`, it is possible to use an HTTP redirect to avoid IP filtering. ### Details In `got.scpaping`, Summaly first makes a HTTP `HEAD` request to the page being summarized. It then preforms private IP address checks on the `HEAD` response, then makes an additional HTTP `GET` request to the page being summarized. Unfortunately, since private IP address checks aren't performed on the `GET` response, the `GET` response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly. ### PoC With a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address: ```caddy @summaly-bypass-head { method HEAD path /summaly-bypass } @summaly-bypass-get { method GET path /summaly-bypass } header @summaly-bypass-head Content-Type "text/html" respond @summaly-bypass-head 200 redir @summaly-bypass-get http://127.0.0.1:3080/ ``` ### Impact Using this bypass, an attacker can probe a victims internal network for HTTP services that aren't supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.

GHSA-jqx4-9gpq-rppm Affected @misskey dev/summaly Versions

1 component(s)
Fixed Versions:
5.2.1
Product / Package Ecosystem Affected Versions Fixed Version
@misskey-dev/summaly
npm/@misskey-dev/summaly
npm
≥ 5.1.0
< 5.2.1
5.2.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/misskey-dev/summaly/security/advisories/GHSA-jqx4-9gpq-rppm
Security Fix Commit FIX COMMIT
https://github.com/misskey-dev/summaly/commit/dfe6451012aac42eabe71d4ed721d8058c4066b4
@misskey dev/summaly Source Repository REPOSITORY
https://github.com/misskey-dev/summaly

Frequently Asked Questions

What is GHSA-jqx4-9gpq-rppm?
GHSA-jqx4-9gpq-rppm is a security vulnerability in @misskey dev/summaly involving @misskey-dev/summaly allows IP Filter Bypass via Redirect under CWE-346: Origin Validation Error.
Which @misskey dev/summaly versions are affected?
Affected versions include releases prior to 5.2.1 across affected packages: @misskey-dev/summaly.
What version fixes GHSA-jqx4-9gpq-rppm?
Upgrading to 5.2.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @misskey-dev/summaly affected?
Yes, @misskey-dev/summaly is affected in releases prior to 5.2.1. Upgrade your dependency to 5.2.1 or later.
What is the CVSS score of GHSA-jqx4-9gpq-rppm?
GHSA-jqx4-9gpq-rppm has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with GHSA-jqx4-9gpq-rppm?
GHSA-jqx4-9gpq-rppm is classified under CWE-346: Origin Validation Error (The product does not properly verify that the source of data or communication is valid.).
How can I check npm dependencies for GHSA-jqx4-9gpq-rppm?
Run the dependency tree command: 'npm ls @misskey-dev/summaly'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jqx4-9gpq-rppm",
  "modified" : "2025-05-06T16:44:22Z",
  "published" : "2025-05-06T16:44:22Z",
  "aliases" : [ ],
  "summary" : "@misskey-dev/summaly allows IP Filter Bypass via Redirect",
  "details" : "### Summary\nDue to a validation error in `got.scpaping`, it is possible to use an HTTP redirect to avoid IP filtering.\n\n### Details\nIn `got.scpaping`, Summaly first makes a HTTP `HEAD` request to the page being summarized. It then preforms private IP address checks on the `HEAD` response, then makes an additional HTTP `GET` request to the page being summarized. Unfortunately, since private IP address checks aren't performed on the `GET` response, the `GET` response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.\n\n### PoC\nWith a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:\n```caddy\n@summaly-bypass-head {\n    method HEAD\n    path /summaly-bypass\n}\n@summaly-bypass-get {\n    method GET\n    path /summaly-bypass\n}\nheader @summaly-bypass-head Content-Type \"text/html\"\nrespond @summaly-bypass-head 200\nredir @summaly-bypass-get http://127.0.0.1:3080/\n```\n\n### Impact\nUsing this bypass, an attacker can probe a victims internal network for HTTP services that aren't supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@misskey-dev/summaly"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.1.0"
      }, {
        "fixed" : "5.2.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/misskey-dev/summaly/security/advisories/GHSA-jqx4-9gpq-rppm"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/misskey-dev/summaly/commit/dfe6451012aac42eabe71d4ed721d8058c4066b4"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/misskey-dev/summaly"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-346" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-05-06T16:44:22Z",
    "nvd_published_at" : null
  }
}