CVE-2023-28155: Server-Side Request Forgery in Request
Summary
CVE-2023-28155: Server-Side Request Forgery in Request. Affects request versions < 2.88.2. No fix is published. How to fix ↓
Also tracked for
- node-request · Debian:11
The same CVE-2023-28155 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The request package is a popular Node.js module used for making HTTP requests. It provides a simple and convenient API for sending HTTP/HTTPS requests and handling responses. The package is widely used in various applications and frameworks for server-side communication with external services. However, versions up to 2.88.2 of the request package and versions prior to 3.0.0 of the @cypress/request package are vulnerable to a Server-Side Request Forgery (SSRF) attack.
Vulnerability Detail
The vulnerability allows an attacker to bypass SSRF mitigations by exploiting a cross-protocol redirect. This means that an attacker-controlled server can redirect a request from HTTP to HTTPS or from HTTPS to HTTP, effectively bypassing any restrictions or protections in place to prevent SSRF attacks. This can lead to unauthorized access to internal resources, information disclosure, or further exploitation of the target system. It is important to note that the request package is no longer supported by the maintainer.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a fixed version of the request package or switch to an alternative package that is actively maintained and provides proper SSRF protection. For the request package, upgrading to version 2.88.3 or higher is necessary. For the @cypress/request package, upgrading to version 3.0.0 or higher is required. Additionally, it is important to review and update any code that uses the vulnerable package to ensure that proper input validation and sanitization are implemented to mitigate SSRF attacks.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The request package and the @cypress/request package are vulnerable to a Server-Side Request Forgery (SSRF) attack. Upgrading to fixed versions of the packages or switching to alternative packages is necessary to address this vulnerability. It is important to review and update any code that uses the vulnerable packages to ensure proper input validation and sanitization. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for request →
FAQ
This vulnerability allows an attacker to bypass SSRF mitigations and potentially gain unauthorized access to internal resources or disclose sensitive information. It can also be used as a stepping stone for further attacks on the target system.
Versions up to 2.88.2 of the request package are affected by this vulnerability.
Versions prior to 3.0.0 of the @cypress/request package are affected by this vulnerability.
Yes, upgrading to version 2.88.3 or higher of the request package and version 3.0.0 or higher of the @cypress/request package fixes this vulnerability.
No, the request package is no longer supported by the maintainer. It is recommended to switch to an alternative package that provides proper SSRF protection.
References
Related vulnerabilities
Recent vulnerabilities recorded for request.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.