GHSA-vp8w-wj4m-3r7j
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @evershop/evershop | <= 2.1.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrary HTTP or HTTPS URIs, resulting in unexpected requests against internal and external networks.
References
External links from the advisory. They lead to third-party sites.