GHSA-58g2-vgpg-335q

request-baskets vulnerable to Server-Side Request Forgery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-27163

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/darklynx/request-baskets	<= 1.2.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-27163 advisory
https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3 web
https://github.com/darklynx/request-baskets package
https://notes.sjtu.edu.cn/s/MUUhEymt7 web
http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html web
http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html web
http://request-baskets.com web