johannschopplich nuxt-api-party up to 0.22.0 Regular Expression server-side request forgery

Summaryinfo

A vulnerability has been found in johannschopplich nuxt-api-party up to 0.22.0 and classified as critical. This vulnerability affects unknown code of the component Regular Expression Handler. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2023-49799. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in johannschopplich nuxt-api-party up to 0.22.0 (Automation Software). It has been declared as critical. Affected by this vulnerability is an unknown part of the component Regular Expression Handler. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. The summary by CVE is:

`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs.

The weakness was disclosed 12/09/2023 as GHSA-3wfp-253j-5jxv. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-49799 since 11/30/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.22.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• johannschopplich

Name

• nuxt-api-party

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22.0

Website

• Product: https://github.com/johannschopplich/nuxt-api-party/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion