GHSA-p72p-rjr2-r439

Source

https://github.com/advisories/GHSA-p72p-rjr2-r439

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-p72p-rjr2-r439/GHSA-p72p-rjr2-r439.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p72p-rjr2-r439

Published

2019-05-29T20:24:02Z

Modified

2020-08-31T18:35:03Z

Summary

Server-Side Request Forgery in terriajs-server

Details

Versions of terriajs-serverprior to 2.7.4 are vulnerable to Server-Side Request Forgery (SSRF). If an attacker has access to a server whitelisted by the terriajs-server proxy or if the attacker is able to modify the DNS records of a domain whitelisted by the terriajs-server proxy, the attacker can use the terriajs-server proxy to access any HTTP-accessible resources that are accessible to the server, including private resources in the hosting environment.

Recommendation

Upgrade to version 2.7.4 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-05-29T20:23:25Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / terriajs-server

Package

Name: terriajs-server; View open source insights on deps.dev
Purl: pkg:npm/terriajs-server

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-p72p-rjr2-r439/GHSA-p72p-rjr2-r439.json"