Description

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c6126ca7d0eae8af346a. It is best practice to apply a patch to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T17:16:52.370Z",
  "pubdate": "2026-09-20T17:16:52.370Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the NonceGeek dim-sum-app, specifically within the Deno Backend component.\nThe vulnerability resides in the textSearchV2Handler function located in deno/main.tsx, where improper validation of the supabase_url argument permits unauthorized interaction with internal or external resources.\nThis flaw allows remote attackers to manipulate the application into performing requests on its behalf, potentially leading to unauthorized data access, internal service scanning, or exploitation of backend infrastructure.\nGiven that the exploit has been disclosed publicly, the risk of active exploitation is significant. It is imperative to apply the provided patch (8389032e5d52c28c4855c6126ca7d0eae8af346a) to mitigate this vector.\nThe vulnerability requires no authentication or special privileges to execute, posing a high risk to the availability, integrity, and confidentiality of the affected Deno environment.",
  "technicalDetails": "The vulnerability is a Server-Side Request Forgery (SSRF) located within the textSearchV2Handler function of the Deno backend, implemented in the file deno/main.tsx.\nThe root cause is the failure of the application to perform input sanitization or validation on the supabase_url parameter before passing it to internal network-request functions. By supplying a crafted URL, an attacker can influence the destination of the HTTP requests initiated by the server.\nThe exploitation flow begins when an unauthenticated remote attacker sends a malicious request to the textSearchV2Handler endpoint. The attacker provides an arbitrary or malicious URL via the supabase_url argument. Since the application fails to restrict this input to authorized or expected domains, the Deno process executes an outbound request to the attacker-supplied destination.\nThis behavior allows for various post-exploitation impacts, including: 1) Probing the internal network architecture to discover hidden services or resources that are not exposed to the public internet. 2) Interacting with cloud metadata services (e.g., if hosted on AWS, GCP, or Azure) to exfiltrate sensitive environment credentials. 3) Bypassing firewall or Access Control Lists (ACLs) by using the server as a proxy to reach restricted systems. 4) Performing denial-of-service attacks by forcing the server to flood internal or external services with excessive requests.\nBecause the server initiates these requests, the attacker can leverage the trusted identity of the backend service, which may possess privileges that the user does not. The vulnerability exists because the application lacks a whitelist-based validation strategy or proper URI parsing to verify that the target URL conforms to expected schemas and administrative boundaries before attempting the connection.\nThe vulnerability is fully remote and does not require pre-existing authentication, making it a critical entry point for unauthorized reconnaissance and exploitation within the server's network segment."
}