Executive brief
@peertube/embed-api is a JavaScript library used to embed PeerTube video players and content on external websites. A server-side request forgery vulnerability in versions 4.0.0 and earlier allows attackers to make arbitrary HTTP requests from the affected server, potentially accessing internal services, bypassing network controls, or exfiltrating sensitive data.
Technical details
A server-side request forgery (SSRF) vulnerability exists in @peertube/embed-api version 4.0.0 and prior (CWE-918) where the application does not properly validate and restrict the target URLs for import operations. An unauthenticated attacker with network access can craft malicious requests that cause the server to make requests to arbitrary internal or external destinations. The vulnerability was addressed by improving URL validation logic, particularly IP address validation for import target URLs, as evidenced by the patching commit. The fix is available in version 4.1.0-rc.1 and later.
Affected products
- PeerTube embed-api 0 through 4.0.0
Timeline
- 2022-02-09: disclosed
- 2022-02-09: patched: Fix available in version 4.1.0-rc.1