CVE-2020-8205 Server-Side Request Forgery in @uppy/companion
An attacker can exploit a Server-Side Request Forgery flaw in the Uppy library to scan networks or access internal systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8205?
CVE-2020-8205 is a high-severity server-side request forgery vulnerability in uppy, published on 20 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
Weakness: CWE-918
Which versions are affected by CVE-2020-8205?
4 open source packages ship an affected version, including @uppy/companion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@uppy/companion npm | All versions | 1.13.2 |
@uppy/companion npm | All versions | 1.13.2 |
@uppy/companion npm | From 2.0.0-alpha.0 | 2.0.0-alpha.5 |
@uppy/companion npm | From 2.0.0-alpha.0 | 2.0.0-alpha.5 |
Products include Transloadit Uppy.
How do I fix CVE-2020-8205?
Upgrade @uppy/companion to a fixed version for your release line: 1.13.2 or 2.0.0-alpha.5.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-8205 being exploited?
There is no known exploitation of CVE-2020-8205 in the wild and no public exploit code.
Other vulnerabilities in uppy
Sources
Also known as GHSA-9m4x-8w29-r78g.