{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/dssrf--1.0.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-54722"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["dssrf (\u003c= 1.0.3)"],"_cs_severities":["high"],"_cs_tags":["ssrf","validation-bypass","cve-2026-54722"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe dssrf library (v1.0.3) is vulnerable to a Server-Side Request Forgery (SSRF) bypass due to an insecure sanitization routine in the \u003ccode\u003eis_url_safe\u003c/code\u003e function. The function applies a \u003ccode\u003eremove_at_symbol_in_string\u003c/code\u003e helper to the input URL string before the URL is parsed by the standard \u003ccode\u003enew URL()\u003c/code\u003e constructor. This process strips the \u003ccode\u003e@\u003c/code\u003e symbol, which serves as a critical delimiter between the userinfo component and the hostname in a URI.\u003c/p\u003e\n\u003cp\u003eBy removing this delimiter, the resulting hostname is corrupted, causing the internal IP/hostname validation logic to fail to recognize restricted targets. An attacker can craft a URL using the \u003ccode\u003euserinfo@internal-ip\u003c/code\u003e pattern, which passes the validation logic but is interpreted correctly by downstream HTTP clients (e.g., got, axios) to make requests to internal services, such as cloud metadata endpoints (e.g., 169.254.169.254) or internal network infrastructure. This vulnerability is tracked as CVE-2026-54722 and affects all users of dssrf version 1.0.3 and earlier.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to bypass security controls designed to prevent requests to sensitive internal services. This can lead to unauthorized access to internal resources, potential exfiltration of sensitive data, or interactions with cloud metadata services (IMDS) which may contain credentials. The impact is significant for applications relying on dssrf for perimeter security in cloud-native environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to dssrf version 1.0.4 or later immediately to patch the validation logic.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, modify the \u003ccode\u003eis_url_safe\u003c/code\u003e function to remove the \u003ccode\u003eremove_at_symbol_in_string\u003c/code\u003e call.\u003c/li\u003e\n\u003cli\u003eImplement a check for userinfo components after URL parsing: ensure \u003ccode\u003eparsed.username\u003c/code\u003e and \u003ccode\u003eparsed.password\u003c/code\u003e are empty before proceeding with trust decisions.\u003c/li\u003e\n\u003cli\u003eReview applications using dssrf for logs indicating outbound requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) initiated by server-side processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-30T21:29:12Z","date_published":"2026-07-30T21:29:12Z","id":"https://feed.craftedsignal.io/briefs/2026-07-dssrf-ssrf-bypass/","summary":"The dssrf library version 1.0.3 contains an SSRF bypass vulnerability in the is_url_safe function caused by improper character removal before URL parsing, allowing attackers to access restricted internal resources.","title":"SSRF Protection Bypass in dssrf Library via URL Normalization","url":"https://feed.craftedsignal.io/briefs/2026-07-dssrf-ssrf-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Dssrf (\u003c= 1.0.3)","version":"https://jsonfeed.org/version/1.1"}