{"schema_version":"1.7.3","id":"GHSA-j2hp-6m75-v4j4","published":"2025-01-27T20:50:21Z","modified":"2025-01-28T15:41:48.647690Z","aliases":["CVE-2025-24354","GO-2025-3422"],"summary":"imgproxy is vulnerable to SSRF against 0.0.0.0","details":"### Summary\n\nImgproxy does not block the `0.0.0.0` address, even with `IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES` set to false. This can expose services on the local host.\n\n### Details\n\nimgproxy protects against SSRF against a loopback address with the following check ([source](https://github.com/imgproxy/imgproxy/blob/0f37d62fd8326a32c213b30dd52e2319770885d8/security/source.go#L43C1-L47C1)):\n\n```\nif !config.AllowLoopbackSourceAddresses && ip.IsLoopback() {\n\treturn ErrSourceAddressNotAllowed\n}\n```\n\nThis check is insufficient to prevent accessing services on the local host, as services may receive traffic on `0.0.0.0`. Go's `IsLoopback` ([source](https://github.com/golang/go/blob/40b3c0e58a0ae8dec4684a009bf3806769e0fc41/src/net/ip.go#L126-L131)) strictly follows the definition of loopback IPs beginning with `127`. `0.0.0.0` is not blocked.","affected":[{"package":{"name":"github.com/imgproxy/imgproxy","ecosystem":"Go","purl":"pkg:golang/github.com/imgproxy/imgproxy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.27.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-j2hp-6m75-v4j4/GHSA-j2hp-6m75-v4j4.json"}}],"references":[{"type":"WEB","url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-j2hp-6m75-v4j4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24354"},{"type":"WEB","url":"https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081"},{"type":"PACKAGE","url":"https://github.com/imgproxy/imgproxy"}],"database_specific":{"cwe_ids":["CWE-918"],"github_reviewed":true,"github_reviewed_at":"2025-01-27T20:50:21Z","nvd_published_at":"2025-01-27T18:15:41Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}