CVE-2022-0086: Server-Side Request Forgery (SSRF) in uppy
Summary
CVE-2022-0086: uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF). Affects uppy versions < 2.3.3. Fixed in 2.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
uppy is an npm package that provides a versatile file uploader for web applications. It offers a range of features and integrations to simplify the process of uploading files. However, uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) attacks when handling IPv4-mapped IPv6 addresses.
Vulnerability Detail
The vulnerability in uppy's companion module allows an attacker to manipulate the application into making unintended requests to internal resources or external systems. By using IPv4-mapped IPv6 addresses, an attacker can bypass security measures and potentially access sensitive information or perform actions on behalf of the application. This vulnerability has a CVSS score of 8.2, indicating a high severity level.
How To Fix
Minimum fixed version
2.3.3
This is the first release that contains the fix.
npm install uppy@2.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the uppy package to the latest version to mitigate the risk of SSRF attacks.
Conclusion
The uppy package's companion module is vulnerable to Server-Side Request Forgery (SSRF) attacks when handling IPv4-mapped IPv6 addresses. To mitigate this vulnerability, it is crucial to update the uppy package to version 2.3.3 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for uppy →
FAQ
uppy is an npm package that provides a file uploader for web applications. It simplifies the process of uploading files and offers various features and integrations.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to manipulate an application into making unintended requests to internal resources or external systems.
The SSRF vulnerability in uppy's companion module is triggered when handling IPv4-mapped IPv6 addresses. Attackers can use this vulnerability to bypass security measures and potentially access sensitive information or perform unauthorized actions.
This vulnerability has a CVSS score of 8.2, indicating a high severity level.
To fix this vulnerability, update the uppy package to version 2.3.3 or later. This update includes a patch that addresses the SSRF vulnerability.
