happy-domで信頼できないHTMLの解析時に内部ネットワークへのサーバー側リクエストが発生する脆弱性

Summary

happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default (disableIframePageLoading: false, disableCSSFileLoading: false). When an application uses happy-dom to parse untrusted HTML on the server side, an attacker can trigger Server-Side Request Forgery by embedding these elements.

Affected Versions

• happy-dom <= 20.8.9 (latest)

Vulnerable Behavior

By default, happy-dom has:

• disableIframePageLoading: false — iframes fetch their src URL via real HTTP requests
• disableCSSFileLoading: false — `` stylesheets fetch their href URL via real HTTP requests

When untrusted HTML is parsed, these elements trigger real server-side HTTP requests to whatever URLs are specified. No special configuration or opt-in is needed.

Proof of Concept

Verified test (attacker server receives requests):

const http = require('http');
const { Window } = require('happy-dom');

// Start attacker server
const srv = http.createServer((req, res) => {
    console.log(`SSRF HIT: ${req.method} ${req.url}`);
    res.writeHead(200, {'Content-Type': 'text/html'});
    res.end('stolen');
});

srv.listen(9995, () => {
    // iframe SSRF — happy-dom makes a real GET request
    const win1 = new Window({ url: 'http://localhost' });
    win1.document.write('');

    // stylesheet SSRF — happy-dom makes a real GET request
    const win2 = new Window({ url: 'http://loc…