This SSRF vulnerability in TREK's trip management platform reveals a structural failure that goes beyond a single coding mistake. The codebase contains both checkSsrf() (URL validation at entry) and safeFetch() (DNS pinning throughout redirect resolution), yet developers chose the incomplete protection at three separate sink points. The critical architectural problem: neither primitive was enforced as canonical, leaving developers to select between a broken security pattern and a correct one based on what was easiest to reach. The checkSsrf() guard validates the initial URL but provides no protection once the server follows a redirect — an attacker supplying a benign-looking endpoint that redirects to 169.254.169.254 bypasses the check entirely. Meanwhile, the DNS-pinned safeFetch() that would have prevented this sits elsewhere, unused.
The CVSS 5.3 rating is difficult to justify. Access to cloud metadata endpoints via blind SSRF is primarily a lateral movement and state-modification primitive, not a data-exfiltration story. An authenticated trip member who can trigger GET requests through these sinks could potentially reach the metadata service, and the impact depends on whether the application's request-handling logic chains those responses to further outgoing calls — a pattern the CVE doesn't fully characterize. The 'authenticated user' access model adds a friction element (attackers need a valid account and trip membership), but this is a detection throttle rather than a true severity mitigator.
For defenders: audit your service-layer HTTP calls for any use of native fetch() or axios that follows redirects, and verify whether checkSsrf() or equivalent guards actually track final resolved destinations. The presence of an SSRF validation function in a codebase should trigger scrutiny of whether it handles redirects, not confidence that the class is handled. If your codebase has a safe alternative (DNS pinning, hostname allowlisting at socket creation), treat the existence of both as a governance failure that needs immediate consolidation — make the safe primitive the only primitive, not merely a discouraged alternative.