Summary
Happy DOM's ServerRendererServer can be abused to make unauthenticated HTTP/2 requests to attacker-selected HTTP or HTTPS destinations. If the renderer is reachable and its server can access internal or local services, the attacker may retrieve and relay response headers and bodies through the renderer.
Happy DOM's ServerRendererServer can be abused to make unauthenticated HTTP/2 requests to attacker-selected HTTP or HTTPS destinations. If the renderer is reachable and its server can access internal or local services, the attacker may retrieve and relay response headers and bodies through the renderer.
Affected context
The issue affects deployments using the Happy DOM server-renderer package where ServerRendererServer accepts incoming HTTP/2 requests and uses the request's :path value to construct a fetch destination. Risk is higher when the renderer is network-accessible and the hosting environment can reach private networks, localhost services, cloud metadata endpoints, or other restricted resources.
The issue affects deployments using the Happy DOM server-renderer package where ServerRendererServer accepts incoming HTTP/2 requests and uses the request's :path value to construct a fetch destination. Risk is higher when the renderer is network-accessible and the hosting environment can reach private networks, localhost services, cloud metadata endpoints, or other restricted resources.
Exploit preconditions
- Attack surface: The ServerRendererServer HTTP/2 request interface
- Required access: Ability to send requests to the renderer; authentication is not required by the affected request handler
- Trigger point: Processing an attacker-controlled
:pathvalue before an outbound fetch - Why exploitation is possible: The resolved destination is not sufficiently constrained to the trusted server origin before the server performs the fetch and relays the response
- Attack surface: The ServerRendererServer HTTP/2 request interface
- Required access: Ability to send requests to the renderer; authentication is not required by the affected request handler
- Trigger point: Processing an attacker-controlled
:pathvalue before an outbound fetch - Why exploitation is possible: The resolved destination is not sufficiently constrained to the trusted server origin before the server performs the fetch and relays the response
Why this happens
The vulnerability results from treating a client-controlled path as trustworthy when constructing an outbound request destination. A protocol-relative path can alter the resolved origin, allowing the server to act as a proxy to an arbitrary reachable endpoint. This maps to CWE-918: Server-Side Request Forgery, where server-side network access is influenced by untrusted input without adequate destination validation.
The vulnerability results from treating a client-controlled path as trustworthy when constructing an outbound request destination. A protocol-relative path can alter the resolved origin, allowing the server to act as a proxy to an arbitrary reachable endpoint. This maps to CWE-918: Server-Side Request Forgery, where server-side network access is influenced by untrusted input without adequate destination validation.
Potential impact
- An attacker may retrieve responses from internal or local services
- Sensitive service headers or response bodies could be exposed
- Cloud or container metadata may be accessible where network controls permit
- Internal network reconnaissance could be enabled
- The renderer could be misused as a proxy against external systems
- An attacker may retrieve responses from internal or local services
- Sensitive service headers or response bodies could be exposed
- Cloud or container metadata may be accessible where network controls permit
- Internal network reconnaissance could be enabled
- The renderer could be misused as a proxy against external systems
General mitigation guidance
Mitigation typically focuses on enforcing a strict outbound request trust boundary.
Common defensive patterns include:
- Accepting only relative paths that cannot change the destination origin
- Validating the fully resolved URL against an explicit allowlist of schemes, hosts, ports, and origins
- Blocking loopback, link-local, private, reserved, and other restricted address ranges after DNS resolution
- Revalidating destinations across redirects and preventing unexpected protocol changes
- Limiting outbound network access from the renderer through egress controls
- Requiring authentication and authorization for renderer endpoints where feasible
- Returning only the minimum response data required by the application
- Running the renderer with least-privilege network and process permissions
Mitigation typically focuses on enforcing a strict outbound request trust boundary.
Common defensive patterns include:
- Accepting only relative paths that cannot change the destination origin
- Validating the fully resolved URL against an explicit allowlist of schemes, hosts, ports, and origins
- Blocking loopback, link-local, private, reserved, and other restricted address ranges after DNS resolution
- Revalidating destinations across redirects and preventing unexpected protocol changes
- Limiting outbound network access from the renderer through egress controls
- Requiring authentication and authorization for renderer endpoints where feasible
- Returning only the minimum response data required by the application
- Running the renderer with least-privilege network and process permissions
How teams detect issues like this
Organizations commonly detect SSRF risks through:
- Static analysis rules for URL construction or fetch calls that incorporate request-controlled values
- Code review checks for origin validation, protocol-relative URLs, redirects, and DNS rebinding concerns
- Dynamic testing with controlled external endpoints and blocked internal-address test cases
- Network telemetry identifying unexpected renderer connections to private, loopback, metadata, or unusual external destinations
- Web application firewall and API policy rules restricting unsupported URL forms and unauthorized HTTP/2 access
- Automated security review tools that flag server-side requests derived from untrusted input
Organizations commonly detect SSRF risks through:
- Static analysis rules for URL construction or fetch calls that incorporate request-controlled values
- Code review checks for origin validation, protocol-relative URLs, redirects, and DNS rebinding concerns
- Dynamic testing with controlled external endpoints and blocked internal-address test cases
- Network telemetry identifying unexpected renderer connections to private, loopback, metadata, or unusual external destinations
- Web application firewall and API policy rules restricting unsupported URL forms and unauthorized HTTP/2 access
- Automated security review tools that flag server-side requests derived from untrusted input
