CVE-2023-28155 Server-Side Request Forgery in Request
An attacker can bypass SSRF protections in the Node.js Request package by using cross-protocol redirects, affecting unsupported software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-28155?
CVE-2023-28155 is a medium-severity server-side request forgery vulnerability in n/a, published on 16 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-918
Which versions are affected by CVE-2023-28155?
4 open source packages ship an affected version, including @cypress/request and request. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@cypress/request npm | All versions | 3.0.0 |
@cypress/request npm | All versions | 3.0.0 |
request npm | All versions to 2.88.2 | None |
request npm | All versions to 2.88.2 | None |
Products include Request Project Request.
How do I fix CVE-2023-28155?
Upgrade @cypress/request to 3.0.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-28155 being exploited?
There is no known exploitation of CVE-2023-28155 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-25664, AZL-43444, AZL-44241, CLSA-2026-1773965914, CLSA-2026-1775003197, CLSA-2026-1775003222 and 10 more.