CVE-2021-23664: Server-side Request Forgery in @isomorphic-git/cors-proxy
Summary
CVE-2021-23664: Server side request forgery in @isomorphic-git/cors-proxy. Affects @isomorphic-git/cors-proxy versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @isomorphic-git/cors-proxy package is an npm package that provides a middleware for handling Cross-Origin Resource Sharing (CORS) requests in isomorphic-git. It is used to proxy requests from a client to a remote Git server, allowing the client to bypass CORS restrictions. This package is widely used in applications that interact with Git repositories. However, versions before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) attacks due to inadequate sanitization and validation of the redirection action in the middleware.js file.
Vulnerability Detail
The vulnerability in @isomorphic-git/cors-proxy allows an attacker to forge requests from the server to other internal or external resources. By manipulating the redirection action, an attacker can make the server send requests to unintended destinations, potentially leading to unauthorized access, data leakage, or further exploitation of internal systems. This vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
2.7.1
This is the first release that contains the fix.
npm install @isomorphic-git/cors-proxy@2.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the package to mitigate the risk of SSRF attacks.
Conclusion
The @isomorphic-git/cors-proxy package before version 2.7.1 is vulnerable to Server-side Request Forgery (SSRF) attacks. To mitigate this vulnerability, it is crucial to upgrade to the fixed version of the package. Developers should also regularly monitor for vulnerabilities in their application's dependencies using tools like Vulert to ensure the security of their software.
See every vulnerability recorded for @isomorphic-git/cors-proxy →
FAQ
Server-side Request Forgery (SSRF) is a vulnerability that allows an attacker to make a server perform unintended requests to internal or external resources.
The consequences of this vulnerability include unauthorized access to sensitive data, data leakage, and potential exploitation of internal systems.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you if the vulnerability is present.
Yes, upgrading to version 2.7.1 or later of the @isomorphic-git/cors-proxy package fixes this vulnerability.
For further support on vulnerability remediation, you can contact info@devnack.com.
