Server-Side Request Forgery (SSRF) Affecting nossrf package, versions <1.0.4

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.

1. Define an app.js file with the programmatic API of nossrf as follows:

const nossrf = require("nossrf")
const main = async()=>
{
    let is_safe =  await nossrf.asyncValidateUrl("https://google.com") // true means good
    console.log(is_safe)

let is_safe2 =  await nossrf.asyncValidateUrl("https://localtest.me") // true means good
console.log(is_safe2)

}
main()

2. Run the app.js file

3. Validate that the localtest.me hostname resolves to a local IP address space 127.0.0.1 and the SSRF protection mechanism is bypassed since for both of the two URLs the response is true