{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@misskey-dev/summaly"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-06T16:44:22Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nDue to a validation error in `got.scpaping`, it is possible to use an HTTP redirect to avoid IP filtering.\n\n### Details\nIn `got.scpaping`, Summaly first makes a HTTP `HEAD` request to the page being summarized. It then preforms private IP address checks on the `HEAD` response, then makes an additional HTTP `GET` request to the page being summarized. Unfortunately, since private IP address checks aren\u0027t performed on the `GET` response, the `GET` response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.\n\n### PoC\nWith a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:\n```caddy\n@summaly-bypass-head {\n    method HEAD\n    path /summaly-bypass\n}\n@summaly-bypass-get {\n    method GET\n    path /summaly-bypass\n}\nheader @summaly-bypass-head Content-Type \"text/html\"\nrespond @summaly-bypass-head 200\nredir @summaly-bypass-get http://127.0.0.1:3080/\n```\n\n### Impact\nUsing this bypass, an attacker can probe a victims internal network for HTTP services that aren\u0027t supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.",
  "id": "GHSA-jqx4-9gpq-rppm",
  "modified": "2025-05-06T16:44:22Z",
  "published": "2025-05-06T16:44:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/misskey-dev/summaly/security/advisories/GHSA-jqx4-9gpq-rppm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/misskey-dev/summaly/commit/dfe6451012aac42eabe71d4ed721d8058c4066b4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/misskey-dev/summaly"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@misskey-dev/summaly allows IP Filter Bypass via Redirect"
}