CVE-2021-23664 Server-side Request Forgery (SSRF)
An attacker can exploit missing validation in the isomorphic-git CORS proxy to perform Server-side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23664?
CVE-2021-23664 is a high-severity server-side request forgery vulnerability in @isomorphic-git/cors-proxy, published on 21 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.
Weakness: CWE-918
Which versions are affected by CVE-2021-23664?
2 open source packages ship an affected version, including @isomorphic-git/cors-proxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@isomorphic-git/cors-proxy npm | All versions | 2.7.1 |
@isomorphic-git/cors-proxy npm | All versions | 2.7.1 |
Products include Isomorphic-Git Cors-Proxy.
How do I fix CVE-2021-23664?
Upgrade @isomorphic-git/cors-proxy to 2.7.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-23664 being exploited?
There is no known exploitation of CVE-2021-23664 in the wild and no public exploit code.
Sources
Also known as GHSA-v82v-rq72-phq9, SNYK-JS-ISOMORPHICGITCORSPROXY-1734788.