Description
nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. ofetch is used to send the requests.
The library allows the user to send many options directly to ofetch. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow.
Recommendation
Update the nuxt-api-party package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.22.1
- Patched version(s): 0.22.1
References
Could your website be exposed too?
SmartScanner can check your website for DOS by abusing `fetchOptions.retry`. and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SSRF & Credentials Leak - CVE-2023-49799
- Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
- Feathers socket handler allows abusing implicit toString - CVE-2023-37899
- Feathers socket handler allows abusing implicit toString - @feathersjs/socketio - CVE-2023-37899
You might also like:
See something that needs correcting? Let us knowUpdated December 13, 2023