Description
nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/_nuxt_icon/[name].
The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure.
Recommendation
Update the @nuxt/icon package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.4.4
- Patched version(s): 1.4.5
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt Icon affected by a Server-Side Request Forgery (SSRF) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
- Strapi Server-Side Request Forgery (SSRF) - CVE-2024-37818
- uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - CVE-2022-0086
- lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability - CVE-2024-32964
You might also like:
See something that needs correcting? Let us knowUpdated August 06, 2024