Executive brief
@isomorphic-git/cors-proxy is a utility that enables web applications to fetch resources from different origins. A server-side request forgery (SSRF) vulnerability allows attackers to make the proxy server fetch arbitrary URLs without authorization, potentially exposing internal services, stealing credentials, or accessing metadata endpoints on cloud infrastructure.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in @isomorphic-git/cors-proxy before version 2.7.1, caused by missing sanitization and validation of the redirection action in the middleware.js component. The proxy follows HTTP redirects without proper validation, allowing an attacker to supply a malicious URL that the server will follow, reaching internal or restricted network resources. The attack requires only network access to the proxy server and no authentication. An attacker can leverage this to scan internal networks, access cloud metadata services, or reach services only accessible from the proxy's network. The vulnerability was patched in version 2.7.1 by disabling automatic redirect following.
Affected products
- isomorphic-git @isomorphic-git/cors-proxy before 2.7.1
Timeline
- 2022-01-26: disclosed
- 2022-01-24: patched: Fix released in version 2.7.1