Is CVE-2023-28155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-28155 being exploited in the wild.

How severe is CVE-2023-28155?

Low severity, with a CVSS score of 3.1, published 16 March 2023.

Which products and versions are affected?

@cypress/request (npm) SEMVER:introduced=0,fixed=3.0.0; request (npm) SEMVER:introduced=0,last_affected=2.88.2.

Is there a fix for CVE-2023-28155?

Yes. @cypress/request (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-28155 attacked?

It is attacked over the network.

Am I affected by CVE-2023-28155?

Check whether you run @cypress/request (npm) or request (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-28155: Request library SSRF bypass via cross-protocol redirect

CVE-2023-28155 · Severity: low · CVSS 3.1 · Published 2023-03-16

The Request library is a widely-used Node.js package for making HTTP requests in applications. An attacker can bypass the library's built-in protections against Server-Side Request Forgery (SSRF) attacks by setting up a malicious server that redirects requests between protocols (HTTP to HTTPS or vice versa). This could allow an attacker to access internal systems or services that the application should not be able to reach.

Technologies: request (npm). Vendors: npm.

Quick answers

Is CVE-2023-28155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-28155 being exploited in the wild.
How severe is CVE-2023-28155?: Low severity, with a CVSS score of 3.1, published 16 March 2023.
Which products and versions are affected?: @cypress/request (npm) SEMVER:introduced=0,fixed=3.0.0; request (npm) SEMVER:introduced=0,last_affected=2.88.2.
Is there a fix for CVE-2023-28155?: Yes. @cypress/request (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-28155 attacked?: It is attacked over the network.
Am I affected by CVE-2023-28155?: Check whether you run @cypress/request (npm) or request (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@cypress/request (npm): upgrade to 3.0.0 or later
```
npm install @cypress/request@3.0.0
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Request library (through version 2.88.2) and @cypress/request (prior to 3.0.0) due to improper validation of SSRF mitigations during cross-protocol redirects. The vulnerable code in the redirect handling logic fails to properly validate requests when a server responds with a redirect from HTTP to HTTPS or vice versa. An attacker controlling a malicious server can craft a redirect response that bypasses the existing SSRF protections, allowing the application to make requests to internal or restricted resources. The attack requires network-level access to intercept or control redirect responses but does not require authentication or user interaction. Patches are available: Request is no longer maintained; @cypress/request has been fixed in version 3.0.0.

Affected products

Request request through 2.88.2
Cypress @cypress/request prior to 3.0.0

Identifiers

CVE-2023-28155
GHSA-p8p7-x288-28g6

Timeline

2023-03-16: disclosed: Advisory published
2023-03-16: patched: @cypress/request version 3.0.0 released with fix

References

https://github.com/request/request/issues/3442

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.