CVE-2024-39687

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue.

• CWE-918

• https://github.com/dahlia/fedify/commit/30f9cf4a175704a04c874f3ea88414c5f1e00b28
• https://github.com/dahlia/fedify/commit/c641e976089dd913f649889c1bfb016df04e86ba
• https://github.com/dahlia/fedify/security/advisories/GHSA-p9cg-vqcc-grcx
• https://github.com/dahlia/fedify/commit/30f9cf4a175704a04c874f3ea88414c5f1e00b28
• https://github.com/dahlia/fedify/commit/c641e976089dd913f649889c1bfb016df04e86ba
• https://github.com/dahlia/fedify/security/advisories/GHSA-p9cg-vqcc-grcx

Published

Jul 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39681Cooked is a recipe plugin for WordPress. The Cooked plugin f…8.8
• CVE-2024-39682Cooked is a recipe plugin for WordPress. The Cooked plugin f…5.4
• CVE-2024-39683ZITADEL is an open-source identity infrastructure tool. ZITA…6.5
• CVE-2024-39684Tencent RapidJSON is vulnerable to privilege escalation due …7.8
• CVE-2024-39685Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…9.8
• CVE-2024-39686Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…9.8
• CVE-2024-39688Bert-VITS2 is the VITS2 Backbone with multilingual bert. Use…6.5
• CVE-2024-39689Certifi is a curated collection of Root Certificates for val…7.5
• CVE-2024-3969XML External Entity injection vulnerability found in OpenTex…9.8
• CVE-2024-39690Capsule is a multi-tenancy and policy-based framework for Ku…8.8
• CVE-2024-39691matrix-appservice-irc is a Node.js IRC bridge for the Matrix…4.3
• CVE-2024-39693Next.js is a React framework. A Denial of Service (DoS) cond…7.5