GHSA-fwvg-2739-22v7

Suggest an improvement
Source
https://github.com/advisories/GHSA-fwvg-2739-22v7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-fwvg-2739-22v7/GHSA-fwvg-2739-22v7.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-fwvg-2739-22v7
Aliases
Related
Published
2023-12-29T19:36:41Z
Modified
2024-01-02T05:57:49.664846Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Miniflare vulnerable to Server-Side Request Forgery (SSRF)
Details

Impact

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

Patches

The issue was fixed in miniflare@3.20231030.2.

Workarounds

Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the host: "127.0.0.1" option.

References

  • https://github.com/cloudflare/workers-sdk/pull/4532
Database specific 
{
    "nvd_published_at": "2023-12-29T12:15:47Z",
    "cwe_ids": [
        "CWE-918"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-29T19:36:41Z"
}
References

Affected packages

npm / miniflare

Package

Name
miniflare
View open source insights on deps.dev
Purl
pkg:npm/miniflare

Affected ranges

Type
SEMVER
Events
Introduced
3.20230821.0
Fixed
3.20231030.2