GHSA-mf74-qq7w-6j7v: Remark images download Zmarkdown Server-Side Request Forgery (SSRF) Vulnerability

MODERATE
Share
Published
Advisory Summary

GHSA-mf74-qq7w-6j7v is a MODERATE zmarkdown server-side request forgery (ssrf) vulnerability (General Security Weakness) affecting Remark images download libraries in the npm ecosystem. The issue involves zmarkdown server-side request forgery (ssrf) in remark-download-images. Remediation is available by upgrading affected packages to version 3.1.0.

GHSA-mf74-qq7w-6j7v at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-mf74-qq7w-6j7v
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Remark images download
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-mf74-qq7w-6j7v

To remediate this vulnerability, upgrade all affected Remark images download dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

remark-images-download fixed: 3.1.0 
npm install remark-images-download@3.1.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls remark-images-download

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-mf74-qq7w-6j7v, inspect your project dependencies using npm:

npm ls remark-images-download

Analyze the terminal output to locate any version of Remark images download in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.0), your application is affected.

Note: The npm ls remark-images-download command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Remark images download, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact A major blind SSRF has been found in `remark-images-download`, which allowed for requests to be made to neighboring servers on local IP ranges. The issue came from a loose filtering of URLs inside the module. Imagine a server running on a private network `192.168.1.0/24`. A private service serving images is running on `192.168.1.2`, and is not expected to be accessed by users. A machine is running `remark-images-download` on the neighboring `192.168.1.3` host. An user enters the following Markdown: ```markdown ![](http://192.168.1.2/private-img.png) ``` The image is downloaded by the server and included inside the resulting document. Hence, the user has access to the private image. It has been corrected by preventing images downloads from local IP ranges, both in IPv4 and IPv6. To avoid malicious domain names, resolved local IPs from are also forbidden inside the module. This vulnerability impact is moderate, as it is can allow access to unexposed documents on the local network, and is very easy to exploit. ### Patches The vulnerability has been patched in version 3.1.0. If impacted, you should update to this version as soon as possible. Please note that a minor version has been released instead of a bugfix. This is due to a new option included to prevent another vulnerability, upgrading to the new version will not break compatibility. ### Workarounds No workaround is known, the package should be upgraded. ### For more information If you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).

GHSA-mf74-qq7w-6j7v Affected Remark images download Versions

1 component(s)
Fixed Versions:
3.1.0
Product / Package Ecosystem Affected Versions Fixed Version
remark-images-download
npm/remark-images-download
npm
< 3.1.0
3.1.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/zestedesavoir/zmarkdown/security/advisories/GHSA-mf74-qq7w-6j7v
Remark images download Source Repository REPOSITORY
https://github.com/zestedesavoir/zmarkdown

Frequently Asked Questions

What is GHSA-mf74-qq7w-6j7v?
GHSA-mf74-qq7w-6j7v is a security vulnerability in Remark images download involving Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images under General Security Weakness.
Which Remark images download versions are affected?
Affected versions include releases prior to 3.1.0 across affected packages: remark-images-download.
What version fixes GHSA-mf74-qq7w-6j7v?
Upgrading to 3.1.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is remark-images-download affected?
Yes, remark-images-download is affected in releases prior to 3.1.0. Upgrade your dependency to 3.1.0 or later.
What CWE is associated with GHSA-mf74-qq7w-6j7v?
GHSA-mf74-qq7w-6j7v is classified under General Security Weakness.
How can I check npm dependencies for GHSA-mf74-qq7w-6j7v?
Run the dependency tree command: 'npm ls remark-images-download'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mf74-qq7w-6j7v",
  "modified" : "2024-05-14T22:02:19Z",
  "published" : "2024-02-03T00:38:22Z",
  "aliases" : [ ],
  "summary" : "Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images",
  "details" : "### Impact\n\nA major blind SSRF has been found in `remark-images-download`, which allowed\nfor requests to be made to neighboring servers on local IP ranges.\nThe issue came from a loose filtering of URLs inside the module.\n\nImagine a server running on a private network `192.168.1.0/24`.\nA private service serving images is running on `192.168.1.2`, and\nis not expected to be accessed by users. A machine is running\n`remark-images-download` on the neighboring `192.168.1.3` host.\nAn user enters the following Markdown:\n\n```markdown\n![](http://192.168.1.2/private-img.png)\n```\n\nThe image is downloaded by the server and included inside the resulting\ndocument. Hence, the user has access to the private image.\n\nIt has been corrected by preventing images downloads from\nlocal IP ranges, both in IPv4 and IPv6.\nTo avoid malicious domain names, resolved local IPs from are also\nforbidden inside the module.\nThis vulnerability impact is moderate, as it is can allow access to\nunexposed documents on the local network, and is very easy\nto exploit.\n\n### Patches\n\nThe vulnerability has been patched in version 3.1.0.\nIf impacted, you should update to this version as soon as possible.\n\nPlease note that a minor version has been released instead of a bugfix.\nThis is due to a new option included to prevent another vulnerability,\nupgrading to the new version will not break compatibility.\n\n### Workarounds\n\nNo workaround is known, the package should be upgraded.\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).\n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "remark-images-download"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.1.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/zestedesavoir/zmarkdown/security/advisories/GHSA-mf74-qq7w-6j7v"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/zestedesavoir/zmarkdown"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-02-03T00:38:22Z",
    "nvd_published_at" : null
  }
}