Normal content
\n\n```\n\n### 2. Create a bookmark via the API\n\n```bash\ncurl -X POST http://localhost:3000/api/v1/bookmarks \\\n -H \"Authorization: Bearer YOUR_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"type\": \"link\", \"url\": \"https://attacker.example.com/ssrf.html\"}'\n```\n\n### 3. Result\n\nThe main URL (`https://attacker.example.com/ssrf.html`) passes `validateUrl()` since it resolves to a public IP. After the HTML is fetched, `metascraper-logo-favicon` extracts the favicon URLs and calls `reachable-url`/`got` to verify them. The server makes HTTP GET requests to:\n- `http://169.254.169.254/latest/meta-data/` (AWS IMDS)\n- `http://127.0.0.1:3000/api/v1/users/whoami` (localhost)\n- `http://192.168.1.1/admin` (internal network)\n\nThese requests bypass all SSRF protections.\n\nVerification: Monitor outbound network traffic from the karakeep container or check the logo field in the bookmark response.\n\n## Impact\n\n- **Cloud metadata access**: On AWS/GCP/Azure deployments, the server can be forced to fetch instance metadata (e.g., `http://169.254.169.254/latest/meta-data/iam/security-credentials/`) which may expose IAM credentials.\n- **Internal service discovery**: Attacker can probe internal network services and ports by checking whether the favicon URL was reachable.\n- **Redirect-based data leak**: If an internal service responds with a redirect, the final URL (potentially containing tokens or session data) is stored as the bookmark's logo field and visible to the attacker.\n- **Bypass of explicit security controls**: The application's SSRF protections (IP blacklist, DNS resolution, redirect validation) are rendered ineffective for this code path.\n\n## Suggested Fix\n\n```diff\n// apps/workers/scripts/parseHtmlSubprocess.ts\n+ import { validateUrl } from \"network\";\n+\n+ // Create a got hook that validates URLs before requests\n+ const ssrfHook = {\n+ beforeRequest: [\n+ async (options) => {\n+ const result = await validateUrl(options.url.toString(), false);\n+ if (!result.ok) {\n+ throw new Error(`SSRF blocked: ${result.reason}`);\n+ }\n+ }\n+ ]\n+ };\n+\n metascraperLogo({\n gotOpts: {\n+ hooks: ssrfHook,\n agent: { ... },\n },\n }),\n```\n\nAlternatively, run the parse subprocess in a network-restricted sandbox (network namespace, nsjail, or a Docker container with restricted networking).","published":"2026-05-14T18:26:02Z","modified":"2026-05-14T18:34:54.944207Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@karakeep/sdk","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/karakeep-app/karakeep/pull/2763","label":"karakeep-app/karakeep#2763"},"references":[{"type":"WEB","url":"https://github.com/karakeep-app/karakeep/security/advisories/GHSA-7rx4-c5vx-g8w3"},{"type":"WEB","url":"https://github.com/karakeep-app/karakeep/pull/2763"},{"type":"WEB","url":"https://github.com/karakeep-app/karakeep/commit/3dc321e7d49aa3a1a2493637fb2ee21616fe5fd9"},{"type":"PACKAGE","url":"https://github.com/karakeep-app/karakeep"},{"type":"WEB","url":"https://github.com/karakeep-app/karakeep/releases/tag/v0.32.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-14T18:34:54.944207Z"}}