GitHub Advisoryadvisory · npm

GHSA-p8p7-x288-28g6 Server-Side Request Forgery in Request

MEDIUM Published 2023-03-16 Modified 2024-03-21 Official page ↗
Aliases
CVE-2023-28155
Ecosystem
npm
Packages
request, @cypress/request
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-918
Reviewed
2023-03-16

Affected packages

• npm request: <= 2.88.2 (no fix yet) • npm @cypress/request: < 3.0.0 → fixed in 3.0.0

Description

The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: The `request` package is no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2023-28155 The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References