Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters

Summary

**Product:** Nuxt OG Image **Version:** < 6.2.5 **CWE-ID:** [CWE-918](https://cwe.mitre.org/data/definitions/918.html): Server-Side Request Forgery ## Description The image generation endpoint (`/_og/d/`) accepts user-controlled parameters that are passed to the server-side renderer without proper validation or filtering. An attacker can trigger server-side requests to internal network addresses through multiple vectors. ## Impact - Scanning internal ports and services inaccessible from the outside - Reading sensitive data from cloud infrastructure metadata services (tokens, credentials) when verbose error output is enabled ## Attack Vectors Three distinct vectors were identified, all exploiting the same underlying lack of URL validation: ### Vector 1: CSS `background-image` injection via `style` parameter ``` GET /_og/d/og.png?style=background-image:+url('http://127.0.0.1:8888/secret') ``` ### Vector 2: `<img src>` injection via `html` parameter ``` GET /_og/d/og.png?html=<img src="http://127.0.0.1:8888/secret"> ``` When verbose errors are enabled, the response content is leaked in base64-encoded error messages. ### Vector 3: SVG `<image href>` injection via `html` parameter ``` GET /_og/d/og.png?html=<svg><image href="http://127.0.0.1:8888/secret"></svg> ``` ## Mitigation Fixed in v6.2.5. The image source plugin now blocks requests to private IP ranges (IPv4/IPv6), loopback addresses, link-local addresses, and cloud metadata endpoints. Decimal/hexadecimal IP encoding bypasses are also handled. ## Credits Researcher: Dmitry Prokhorov (Positive Technologies)