What is GHSA-p72p-rjr2-r439?

GHSA-p72p-rjr2-r439 is a security advisory published by GitHub Security Advisories with High severity. Server-Side Request Forgery in terriajs-server

Why does GHSA-p72p-rjr2-r439 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-p72p-rjr2-r439?

GHSA-p72p-rjr2-r439 affects 1 product, including: npm/terriajs-server:\u003c 2.7.4.

GHSA-p72p-rjr2-r439HighDisclosed before NVD

Server-Side Request Forgery in terriajs-server

Vendor

GitHub Security Advisories

Published

May 29, 2019

Last Modified

January 9, 2023

📋 Description

Versions of terriajs-serverprior to 2.7.4 are vulnerable to Server-Side Request Forgery (SSRF). If an attacker has access to a server whitelisted by the terriajs-server proxy or if the attacker is able to modify the DNS records of a domain whitelisted by the terriajs-server proxy, the attacker can use the terriajs-server proxy to access any HTTP-accessible resources that are accessible to the server, including private resources in the hosting environment.

Recommendation

Upgrade to version 2.7.4 or later.

🎯 Affected products1

npm/terriajs-server:< 2.7.4

🔗 References (4)

https://github.com/TerriaJS/terriajs-server/commit/3cbc48475f50a53962f605491d0e60648a29bdf0
https://medium.com/terria/security-vulnerability-in-terriajs-server-82c8bf4da0a5
https://www.npmjs.com/advisories/768
https://github.com/advisories/GHSA-p72p-rjr2-r439