GHSA-mm7r-265w-jv6fHigh

Server-Side Request Forgery in @uppy/companion

Published
September 3, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-8135 →

📋 Description

Versions of @uppy/companion prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The get route passes the user-controlled variable req.body.url to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of the server.

Recommendation

Upgrade to version 1.9.3 or later.

🎯 Affected products1

  • npm/@uppy/companion:< 1.9.3

🔗 References (4)