Quick answers
- Is CVE-2022-0086 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-0086 being exploited in the wild.
- How severe is CVE-2022-0086?
- Low severity, with a CVSS score of 3, published 6 January 2022.
- Which products and versions are affected?
- @uppy/companion (npm) SEMVER:introduced=0,fixed=3.1.5.
- Is there a fix for CVE-2022-0086?
- Yes. @uppy/companion (npm): upgrade to 3.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-0086 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-0086?
- Check whether you run @uppy/companion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @uppy/companion (npm): upgrade to 3.1.5 or later
npm install @uppy/companion@3.1.5
Technical details
The vulnerability exists in Uppy Companion's IP address filtering logic, which fails to properly validate IPv4-mapped IPv6 addresses (e.g., ::FFFF:127.0.0.1). An attacker can craft requests using this notation to bypass the private IP check and perform server-side requests to restricted internal resources. The flaw affects all versions prior to 3.1.5 and requires only network reachability to the Companion service with no authentication or user interaction. An attacker can use this to scan internal networks, access private services, or perform actions on behalf of the Companion server. The vulnerability was patched in version 3.1.5 via an improved private IP check mechanism.
Affected products
- Transloadit Uppy Companion before 3.1.5
Identifiers
- CVE-2022-0086
- GHSA-x8rq-rc7x-5fg5
Timeline
- 2022-01-06: disclosed: GHSA-x8rq-rc7x-5fg5 published
- 2022-01-04: patched: Fixed in version 3.1.5