Executive brief
nuxt-api-party is a tool used by developers to securely connect web applications to backend APIs without exposing sensitive credentials to users. A flaw in how the tool validates web addresses allows an attacker to bypass security checks by adding hidden characters (like a new line) to a URL. This could allow an attacker to trick the server into sending sensitive API keys to a server they control or making unauthorized requests to internal systems.
Technical details
The nuxt-api-party module fails to properly validate absolute URLs due to a flawed regular expression check (^https?://). An attacker can bypass this check by prepending whitespace characters, such as a newline (\n), to a URL. Because the underlying 'fetch' implementation normalizes URLs by stripping leading whitespace before execution, the bypass results in a request to an arbitrary external destination. This allows for Server-Side Request Forgery (SSRF) and the potential leakage of proxied API credentials to attacker-controlled endpoints. The vulnerability was introduced by a change in URL detection logic and is fixed in version 0.22.0 by using a more robust URL origin check.
Affected products
- johannschopplich nuxt-api-party < 0.22.0
Timeline
- 2023-12-08: advisory: Original GitHub security advisory published
- 2023-12-08: patched: Fix committed to repository
- 2023-12-12: disclosed: Public disclosure via GHSA and OSV
References
- https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv
- https://github.com/johannschopplich/nuxt-api-party/commit/72762a200fc19d997a0f84bce578c28698dc5270
- https://fetch.spec.whatwg.org/
- https://fetch.spec.whatwg.org/
- https://github.com/johannschopplich/nuxt-api-party
- https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts