{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49799", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-11-30T13:39:50.864Z", "datePublished": "2023-12-08T23:45:18.581Z", "dateUpdated": "2024-08-02T22:01:25.998Z"}, "containers": {"cna": {"title": "Server-Side Request Forgery in nuxt-api-party", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv"}, {"name": "https://fetch.spec.whatwg.org/", "tags": ["x_refsource_MISC"], "url": "https://fetch.spec.whatwg.org/"}, {"name": "https://fetch.spec.whatwg.org/#http-whitespace-byte", "tags": ["x_refsource_MISC"], "url": "https://fetch.spec.whatwg.org/#http-whitespace-byte"}, {"name": "https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31", "tags": ["x_refsource_MISC"], "url": "https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31"}, {"name": "https://infra.spec.whatwg.org/#byte-sequence", "tags": ["x_refsource_MISC"], "url": "https://infra.spec.whatwg.org/#byte-sequence"}], "affected": [{"vendor": "johannschopplich", "product": "nuxt-api-party", "versions": [{"version": "< 0.22.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-08T23:45:18.581Z"}, "descriptions": [{"lang": "en", "value": "`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. \"To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.\". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs."}], "source": {"advisory": "GHSA-3wfp-253j-5jxv", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:01:25.998Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv"}, {"name": "https://fetch.spec.whatwg.org/", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://fetch.spec.whatwg.org/"}, {"name": "https://fetch.spec.whatwg.org/#http-whitespace-byte", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://fetch.spec.whatwg.org/#http-whitespace-byte"}, {"name": "https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31"}, {"name": "https://infra.spec.whatwg.org/#byte-sequence", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://infra.spec.whatwg.org/#byte-sequence"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:johannschopplich:nuxt_api_party:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "3FF05127-C972-40EC-A3E2-6733D255DAA2", "versionEndIncluding": "0.21.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. \"To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.\". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs."}, {"lang": "es", "value": "`nuxt-api-party` es un m\u00f3dulo de c\u00f3digo abierto para enviar solicitudes de API. nuxt-api-party intenta comprobar si el usuario ha pasado una URL absoluta para evitar el ataque antes mencionado. Esto se cambi\u00f3 recientemente para usar la expresi\u00f3n regular `^https?://`; sin embargo, esta expresi\u00f3n regular se puede omitir mediante una URL absoluta con espacios en blanco al principio. Por ejemplo `\\nhttps://whatever.com` que tiene una nueva l\u00ednea inicial. Seg\u00fan la especificaci\u00f3n de recuperaci\u00f3n, antes de realizar una recuperaci\u00f3n, la URL se normaliza. \"Para normalizar una secuencia de bytes de valor potencial, elimine los bytes de espacio en blanco HTTP iniciales y finales de valor potencial\". Esto significa que la solicitud final se normalizar\u00e1 en `https://whatever.com` sin pasar por la verificaci\u00f3n y nuxt-api-party enviar\u00e1 una solicitud fuera de la lista blanca. Esto podr\u00eda permitirnos filtrar credenciales o realizar Server-Side Request Forgery (SSRF). Esta vulnerabilidad se ha solucionado en la versi\u00f3n 0.22.1. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben volver al m\u00e9todo anterior para detectar URL absolutas."}], "id": "CVE-2023-49799", "lastModified": "2023-12-13T17:25:57.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-12-09T00:15:07.393", "references": [{"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://fetch.spec.whatwg.org/"}, {"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://fetch.spec.whatwg.org/#http-whitespace-byte"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv"}, {"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://infra.spec.whatwg.org/#byte-sequence"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}