Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
## Summary
The `clerkFrontendApiProxy` function in `@clerk/backend` is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's `Clerk-Secret-Key` to an attacker-controlled server.
## Affected packages
Only applications that have opted into the `frontendApiProxy` feature are affected. This feature is not enabled by default. **Users of `@clerk/nextjs` are not affected** due to how the framework handles repeated `/` in request paths.
| Package | Affected versions | Fixed version |
|---|---|---|
| `@clerk/backend` | `>= 3.0.0, <= 3.2.2` | `3.2.3` |
| `@clerk/express` | `>= 2.0.0, <= 2.0.6` | `2.0.7` |
| `@clerk/hono` | `>= 0.1.0, <= 0.1.4` | `0.1.5` |
| `@clerk/fastify` | `>= 3.1.0, <= 3.1.4` | `3.1.5` |
Search your codebase for the `frontendApiProxy` option. If none of the patterns below appear in your code, you are not affected.
**@clerk/express**
```ts
app.use(clerkMiddleware({ frontendApiProxy: { enabled: true } }));
```
**@clerk/hono**
```ts
app.use('*', clerkMiddleware({ frontendApiProxy: { enabled: true } }));
```
**@clerk/fastify**
```ts
fastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } });
```
**@clerk/backend**
```ts
import { clerkFrontendApiProxy } from '@clerk/backend/proxy';
```
A quick way to check across your entire project:
```sh
grep -r "frontendApiProxy\|clerkFrontendApiProxy" .
```
If there are no matches, you are not using this feature.
## Recommended actions
Clerk's internal logs show no evidence of users utilizing the built-in proxy with the impacted versions. Despite that, if you are on an impacted version and use the built-in proxy we recommend upgrading and rotating your Clerk Secret Key immediately.
1. **Upgrade** to the patched version of `@clerk/backend` (and `@clerk/express`, `@clerk/hono`, etc.)
2. **Rotate your Clerk Secret Key** after upgrading - if an attacker exploited this vulnerability, they may have captured your key. Rotate it in the Clerk Dashboard
https://dashboard.clerk.com under **API Keys**. You should deploy your application with the updated key before revoking the existing key.
3. **Audit access logs** for requests to your proxy endpoint (`/__clerk/` by default) containing double slashes in the path.
## Credit
Discovered during an internal code audit.