CVE-2023-5572: Server-Side Request Forgery (SSRF) in @vrite/sdk
Summary
CVE-2023-5572: Server-Side Request Forgery (SSRF) in vriteio/vrite. Affects @vrite/sdk versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @vrite/sdk package is an npm package that provides a software development kit (SDK) for interacting with the vrite.io platform. The vrite.io platform is a service that allows users to manage and analyze data. The @vrite/sdk package is used by developers to integrate their applications with the vrite.io platform, enabling them to perform various operations such as data retrieval, data manipulation, and data analysis. However, prior to version 0.3.0, the @vrite/sdk package is vulnerable to a Server-Side Request Forgery (SSRF) attack.
Vulnerability Detail
The Server-Side Request Forgery (SSRF) vulnerability in the @vrite/sdk package allows an attacker to make arbitrary HTTP requests from the server-side, potentially leading to unauthorized access to internal resources or services. This vulnerability can be exploited by an attacker to bypass security controls, perform reconnaissance, or launch further attacks against other systems or services accessible from the server. The vulnerability has a CVSS score of 10.0, indicating its critical severity.
How To Fix
Minimum fixed version
0.3.0
This is the first release that contains the fix.
npm install @vrite/sdk@0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the @vrite/sdk package to mitigate the SSRF vulnerability.
Conclusion
The Server-Side Request Forgery (SSRF) vulnerability in the @vrite/sdk package prior to version 0.3.0 poses a critical risk to applications using this package. To mitigate the vulnerability, it is crucial to upgrade to version 0.3.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @vrite/sdk →
FAQ
The vulnerability allows an attacker to make arbitrary HTTP requests from the server-side, potentially leading to unauthorized access to internal resources or services. This can result in data breaches, privilege escalation, or further attacks against other systems or services accessible from the server.
No, only versions prior to 0.3.0 are affected. It is recommended to upgrade to version 0.3.0 or later to fix the vulnerability.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to address the vulnerability promptly by upgrading to the fixed version of the @vrite/sdk package.
Yes, it is recommended to update all applications that use the @vrite/sdk package to the fixed version (0.3.0 or later) to ensure they are not vulnerable to SSRF attacks.
You can find more information about the vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-w35p-wxwj-rcm9/GHSA-w35p-wxwj-rcm9.json
Related vulnerabilities
Recent vulnerabilities recorded for @vrite/sdk.
