GitHub Advisoryadvisory · npm

GHSA-fwvg-2739-22v7 Miniflare vulnerable to Server-Side Request Forgery (SSRF)

HIGH Published 2023-12-29 Modified 2023-12-29 Official page ↗
Aliases
CVE-2023-7078
Ecosystem
npm
Packages
miniflare
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-918
Reviewed
2023-12-29

Affected packages

• npm miniflare: >= 3.20230821.0, < 3.20231030.2 → fixed in 3.20231030.2

Description

Impact Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in `wrangler` until `3.19.0`), an attacker on the local network could access other local servers. Patches The issue was fixed in `[email protected]`. Workarounds Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the `host: "127.0.0.1"` option. References • https://github.com/cloudflare/workers-sdk/pull/4532

Related

Alias · CVE (1)

  • CVE-2023-7078 Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References