Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL of the request, potentially leading to credentials being leaked or SSRF. This vulnerability is similar, and was caused by a recent change to the detection of absolute URLs, which is no longer sufficient to prevent SSRF. Details nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use a regular expression ^https?://. This regular expression can be bypassed by an absolute URL with leading whitespace. For example \nhttps://whatever.com has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue." (source) This means the final request will be normalized to…
Recommended action: Upgrade to 0.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. ofetch is used to send the requests. The library allows the user to send many options directly to ofetch. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. Details fetchOptions are obtained directly from the request body. These are then passed directly into ofetch . We can construct a URL we know will not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively. PoC POC using Node. We can use proto as a substitute for the endpoint if it is not known. We can build the size of the stack faster by using more complicated URIs Impact Full DOS, server is unusable during attack. Requires a single request. Fix Limit which options can be passed to ofetch.
Recommended action: Upgrade to 0.22.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.