Server-Side Request Forgery in Request
The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: The `request` package is no longer supported by the maintainer.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-28155US | medium6.1 | — | ||
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to… | ||||
02
references
External citations — patches, advisories, analysis.
- https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdfWEB
- https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116WEB
- https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024fWEB
- https://github.com/cypress-io/request/pull/28WEB
- https://github.com/cypress-io/request/releases/tag/v3.0.0WEB
- https://github.com/github/advisory-database/pull/2500WEB
- https://github.com/request/requestPACKAGE
- https://github.com/request/request/blob/master/lib/redirect.js#L111WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan