CyberRota Analysis
AI-GeneratedThe vulnerability affects Link Preview JS versions prior to 4.0.4, where improper DNS resolution allows an attacker to exploit DNS rebinding, bypassing server-side request forgery (SSRF) protections. This can lead to unauthorized access to internal HTTP resources, posing a significant risk to the confidentiality and integrity of sensitive data. Organizations using affected versions should prioritize upgrading to version 4.0.4 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4.