CVE-2023-49799
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-49799 is a vulnerability affecting the `nuxt-api-party` module, which is used to proxy API requests in Nuxt.js. The issue arises from a flawed check designed to prevent unauthorized API requests. The check uses a regular expression to identify absolute URLs, but it can be bypassed by adding leading whitespace to the URL. This bypass is possible due to URL normalization processes that remove leading and trailing whitespace before the fetch request is made. The consequence of this vulnerability is the potential for Server-Side Request Forgery (SSRF) attacks and credential leaks. Version 0.22.1 of `nuxt-api-party` addresses the issue, and users are advised to upgrade. Those unable to do so should revert to the previous method for detecting absolute URLs.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions