CVE-2020-8135 Server-Side Request Forgery in @uppy/companion
An attacker can exploit this SSRF vulnerability in the Uppy library to scan internal networks or interact with internal systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8135?
CVE-2020-8135 is a critical server-side request forgery vulnerability in uppy, published on 20 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.
Weakness: CWE-918
Which versions are affected by CVE-2020-8135?
2 open source packages ship an affected version, including @uppy/companion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@uppy/companion npm | All versions | 1.9.3 |
@uppy/companion npm | All versions | 1.9.3 |
Products include Uppy Uppy.
How do I fix CVE-2020-8135?
Upgrade @uppy/companion to 1.9.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-8135 being exploited?
There is no known exploitation of CVE-2020-8135 in the wild and no public exploit code.
Sources
Also known as GHSA-mm7r-265w-jv6f.