CVE-2022-0508: Server-Side Request Forgery in @peertube/embed-api
Summary
CVE-2022-0508: Server-Side Request Forgery in @peertube/embed-api. Affects @peertube/embed-api versions < 4.1.0-rc.1. Fixed in 4.1.0-rc.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @peertube/embed-api is an npm package that provides an API for embedding PeerTube videos on websites. It allows developers to easily integrate PeerTube videos into their applications by providing a set of functions and components. However, versions 4.0.0 and prior of this package are vulnerable to server-side request forgery (SSRF).
Vulnerability Detail
Server-side request forgery (SSRF) is a type of vulnerability that allows an attacker to make requests to internal or external resources on behalf of the server. In the case of @peertube/embed-api, this vulnerability can be exploited to perform unauthorized actions, such as accessing internal resources or making requests to external servers. This can lead to information disclosure, unauthorized access, or even remote code execution depending on the specific scenario. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.1.0-rc.1
This is the first release that contains the fix.
npm install @peertube/embed-api@4.1.0-rc.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the latest version of the package to mitigate the risk.
Conclusion
The @peertube/embed-api package versions 4.0.0 and prior are vulnerable to server-side request forgery (SSRF). It is crucial to update to version 4.1.0-rc.1 or later to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @peertube/embed-api →
FAQ
@peertube/embed-api is an npm package that provides an API for embedding PeerTube videos on websites. It simplifies the integration of PeerTube videos into web applications.
Server-side request forgery (SSRF) is a vulnerability that allows an attacker to make requests to internal or external resources on behalf of the server. It can lead to unauthorized access, information disclosure, or remote code execution.
This vulnerability can be exploited to perform unauthorized actions, such as accessing internal resources or making requests to external servers. The specific consequences depend on the attacker's intentions and the server's configuration.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
To fix this vulnerability, update the @peertube/embed-api package to version 4.1.0-rc.1 or later by running the command 'npm install @peertube/embed-api@latest'.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
