SSRF & Credentials Leak

Description

nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF.

Recommendation

Update the nuxt-api-party package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.22.0
• Patched version(s): 0.22.0

References

• GHSA-3wfp-253j-5jxv
• fetch.spec.whatwg.org
• infra.spec.whatwg.org
• CVE-2023-49799
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• RSSHub SSRF vulnerability - CVE-2023-22493
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views (GHSA-v8gg-4mq2-88q4) 2 - CVE-2023-36472
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views (GHSA-v8gg-4mq2-88q4) - CVE-2023-36472
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views - CVE-2023-36472

Tags:

npm

nuxt-api-party