Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2024-42352

High
7.5/10

Summary

Nuxt is a free and open-source framework for creating full-stack web applications and websites with "Vue.js". "nuxt/icon" provides an API allowing client-side icon lookup. This endpoint is at "/api/_nuxt_icon/[name]". The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure. The "new URL" constructor is used to parse the final path. This constructor can be passed a relative scheme or path to change the host to which the request is sent. This constructor is also very tolerant of poorly formatted URLs. As a result, we can pass a path prefixed with the string "http:". This has the effect of changing the scheme to HTTP. We can then pass a new host, such as "http:127.0.0.1:8080". This would allow us to send requests to a local server. This issue has been addressed and all users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability affects @nuxt/icon versions prior to 1.4.5.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published