Threats affecting pkg:github/crawlseo

crawlseo versions prior to 0.2.5 store Google OAuth access and refresh tokens in cleartext within the database. This vulnerability allows attackers with read access to the Postgres database to obtain unencrypted tokens, enabling indefinite unauthorized access to users' Google Search Console data. The issue is fixed in version 0.2.5.

crawlseo versions before 0.2.4 have a server-side request forgery (SSRF) vulnerability in the crawler engine. The isPrivateIp() function fails to block certain reserved IP ranges and does not pin the validated address for outbound connections, allowing a time-of-check to time-of-use (TOCTOU) DNS rebinding bypass. An authenticated attacker can add a malicious domain resolving to internal or restricted addresses, trigger a crawl, and access internal services or cloud metadata endpoints such as 169.254.169.254. The attacker can then retrieve information like page titles, descriptions, headings, status codes, and links via the crawl results API, enabling internal network reconnaissance.