GHSA-5hjh-c26m-xw8wHighCVSS 7.5

ProxyScotch is vulnerable to a server-side Request Forgery (SSRF)

Published
May 3, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2022-25850 →

📋 Description

ProxyScotch is a simple proxy server created for hoppscotch.io. The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.

🎯 Affected products1

  • go/github.com/hoppscotch/proxyscotch:< 1.0.0

🔗 References (4)