GitHub Advisoryadvisory · npm

GHSA-mm7r-265w-jv6f Server-Side Request Forgery in @uppy/companion

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Aliases
CVE-2020-8135
Ecosystem
npm
Packages
@uppy/companion
Severity
High
Weaknesses
CWE-918
Reviewed
2020-08-31

Affected packages

• npm @uppy/companion: < 1.9.3 → fixed in 1.9.3

Description

Versions of `@uppy/companion` prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The `get` route passes the user-controlled variable `req.body.url` to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of the server. Recommendation Upgrade to version 1.9.3 or later.

Related

Alias · CVE (1)

  • CVE-2020-8135 The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References