CVE-2026-54508

This SSRF vulnerability in TREK's trip management platform reveals a structural failure that goes beyond a single coding mistake. The codebase contains both `checkSsrf()` (URL validation at entry) and `safeFetch()` (DNS pinning throughout redirect resolution), yet developers chose the incomplete protection at three separate sink points. The critical architectural problem: neither primitive was enforced as canonical, leaving developers to select between a broken security pattern and a correct one based on what was easiest to reach. The `checkSsrf()` guard validates the initial URL but provides no protection once the server follows a redirect — an attacker supplying a benign-looking endpoint that redirects to 169.254.169.254 bypasses the check entirely. Meanwhile, the DNS-pinned `safeFetch()` that would have prevented this sits elsewhere, unused. The CVSS 5.3 rating is difficult to justify. Access to cloud metadata endpoints via blind SSRF is primarily a lateral movement and state-modification primitive, not a data-exfiltration story. An authenticated trip member who can trigger GET requests through these sinks could potentially reach the metadata service, and the impact depends on whether the application's request-handling logic chains those responses to further outgoing calls — a pattern the CVE doesn't fully characterize. The 'authenticated user' access model adds a friction element (attackers need a valid account and trip membership), but this is a detection throttle rather than a true severity mitigator. For defenders: audit your service-layer HTTP calls for any use of native `fetch()` or `axios` that follows redirects, and verify whether `checkSsrf()` or equivalent guards actually track final resolved destinations. The presence of an SSRF validation function in a codebase should trigger scrutiny of whether it handles redirects, not confidence that the class is handled. If your codebase has a safe alternative (DNS pinning, hostname allowlisting at socket creation), treat the existence of both as a governance failure that needs immediate consolidation — make the safe primitive the only primitive, not merely a discouraged alternative.

Reviewed through automated stages and approved by a human before publication.