any users using 1.1.1.1 DNS is impacted by SSRF

Summary

i found in Tuesday a very highly dangerous vuln and insane on dssrf, the problem lies in the resolver 1.1.1.1 not accept localhost and just say no such domain (NXDOMAIN), error and then anyone using the resolver 1.1.1.1 which most does, maybe other resolvers affected by depends, we known as for now 1.1.1.1 users are vulnerable to SSRF.

POC

example to simulate 1.1.1.1 in version before 1.5.0 of dssrf affected

import { is_url_safe } from '../dist/helpers.js';
import dns from 'dns';


dns.setServers(['1.1.1.1']);

const TARGET = 'http://localhost/admin';

console.log(`Testing: ${TARGET}`);
console.log(`Current DNS Servers: ${dns.getServers()}`);

const result = await is_url_safe(TARGET);

if (result === true) {
    console.log('dssrf treated localhost as SAFE because 1.1.1.1 returned NXDOMAIN.');
} else {
    console.log('dssrf blocked localhost.');
}

as you can here we simulate 1.1.1.1 for node.js and then dssrf return true

all users used 1.1.1.1 as we confirmed now maybe other dnses affected

Appolize

we fixed another advisory in the same day in 1.4.0 but we apolized for not fixing them in one same version