CVE-2025-50180

Executive Summary

CVE-2025-50180 is a full-response Server-Side Request Forgery (SSRF) vulnerability in esm.sh, a no-build content delivery network (CDN) for web development. The vulnerability exists in version 136 of esm.sh, allowing an attacker to craft requests that cause the server to make internal HTTP requests and return the full response to the attacker. This can lead to information disclosure from internal services, such as cloud metadata endpoints, internal APIs, or other sensitive resources. The vulnerability is patched in version 137.

Supply Chain & Package Security

esm.sh is a CDN that serves JavaScript packages from npm. An SSRF vulnerability in the CDN itself can be exploited to access internal infrastructure, potentially compromising the integrity of the package serving pipeline or exposing sensitive configuration data. This is a critical supply chain risk as it affects the core infrastructure used to deliver packages to end users.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (full-response SSRF), a reasonable assessment is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) – Full response disclosure of internal resources.
• Integrity (I): None (N) – No direct modification of data.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Score: 8.6 (High)

Threat Level: High. The vulnerability allows an unauthenticated attacker to read internal resources, which can lead to further compromise.

Deep Dive & Mechanics

The esm.sh CDN processes user-supplied URLs to fetch and serve JavaScript packages. In version 136, the application fails to properly validate or sanitize the target URL, allowing an attacker to specify internal addresses (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, http://localhost:8080/ for internal services). The server then makes an HTTP request to that internal address and returns the full response body to the attacker.

The vulnerability is a classic SSRF where the attacker controls the URL that the server fetches. The "full-response" aspect means the entire HTTP response (including headers and body) is returned, not just a portion.

Vulnerable vs. Patched Code

Vulnerable Code (Version 136):

// Simplified vulnerable code
app.get('/fetch', async (req, res) => {
  const targetUrl = req.query.url;
  const response = await fetch(targetUrl);
  const data = await response.text();
  res.send(data);
});

Patched Code (Version 137):

// Simplified patched code
const allowedHosts = ['cdn.esm.sh', 'registry.npmjs.org'];

app.get('/fetch', async (req, res) => {
  const targetUrl = req.query.url;
  const parsedUrl = new URL(targetUrl);
  
  if (!allowedHosts.includes(parsedUrl.hostname)) {
    return res.status(403).send('Forbidden');
  }
  
  const response = await fetch(targetUrl);
  const data = await response.text();
  res.send(data);
});

The patch introduces a whitelist of allowed hostnames, preventing requests to internal or arbitrary external hosts.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy esm.sh version 136 in a Docker container.
2. Set up a local internal service (e.g., a simple HTTP server on port 8080) to simulate an internal resource.
3. Use a tool like curl or a browser to exploit.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /fetch?url=).
2. Craft a request to an internal resource:

   curl "http://vulnerable-esm.sh/fetch?url=http://localhost:8080/internal-secret"
   

3. Observe the full response from the internal service.

Advanced Exploitation:

• Access cloud metadata endpoints:

  curl "http://vulnerable-esm.sh/fetch?url=http://169.254.169.254/latest/meta-data/"
  

• Use URL encoding or redirects to bypass weak filters (if any).

Blue Team

Detection:

• Monitor outbound HTTP requests from the esm.sh server to unexpected internal IPs (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254).
• Log all requests to the vulnerable endpoint and analyze for suspicious URL patterns.

Mitigation:

• Immediately upgrade to version 137.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to internal IPs.
• Restrict outbound network access from the esm.sh server using firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from esm.sh server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • Requests to cloud metadata IPs (169.254.169.254, 100.100.100.200 for Alibaba Cloud).
  • Unusual User-Agent strings in internal requests.

• File IOCs:

  • Log entries containing internal IP addresses in the url parameter.

• Behavioral IOCs:

  • Multiple requests to the same internal endpoint from the esm.sh server.
  • Requests to non-standard ports (e.g., 8080, 3000) from the esm.sh server.

Detection Engineering

YARA Rule

rule CVE_2025_50180_SSRF_esm_sh {
    meta:
        description = "Detects SSRF attempts against esm.sh CVE-2025-50180"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50180"
    strings:
        $url_param = "url=" nocase
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/ 
        $metadata_ip = "169.254.169.254"
    condition:
        $url_param and ($internal_ip or $metadata_ip)
}

Sigma Rule

title: SSRF Attempt Against esm.sh (CVE-2025-50180)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to esm.sh with internal IP addresses in the URL parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "url="
        cs-uri-query|contains: 
            - "127.0.0.1"
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
            - "169.254."
    condition: selection
falsepositives:
    - Legitimate use of internal services (unlikely in this context)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50180 SSRF Attempt Against esm.sh"; flow:to_server; content:"url="; http_uri; pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade esm.sh to version 137 as soon as possible.
2. If upgrade is not immediately possible, restrict outbound network access from the esm.sh server using firewall rules to only allow connections to trusted external hosts (e.g., registry.npmjs.org).
3. Implement a Web Application Firewall (WAF) rule to block requests containing internal IP addresses in the URL parameter.

Long-term Measures:

1. Conduct a security audit of the esm.sh codebase to identify similar vulnerabilities.
2. Implement input validation for all user-supplied URLs, including a whitelist of allowed hosts.
3. Use a dedicated SSRF prevention library or middleware.
4. Monitor logs for any signs of exploitation.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.