Executive brief
Miniflare is a local Cloudflare Workers development server used by developers to test and debug worker scripts locally. A Server-Side Request Forgery (SSRF) vulnerability allows an attacker on the local network to craft malicious HTTP requests that cause Miniflare to make arbitrary HTTP and WebSocket requests to internal services, potentially exposing data on the local network or accessing restricted endpoints.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) issue in Miniflare's HTTP request handling (CWE-918). By sending specially crafted HTTP requests to Miniflare's server, an attacker can trigger the server to make arbitrary outbound HTTP and WebSocket requests. The attack vector is adjacent (local network), with high attack complexity and no user interaction required. If Miniflare is listening on external network interfaces (the default configuration in wrangler prior to version 3.19.0), an attacker on the same local network can exploit this to access other local servers. The vulnerability was introduced in version 3.20230821.0 and fixed in miniflare@3.20231030.2.
Affected products
- Cloudflare Miniflare >=3.20230821.0, <3.20231030.2
Timeline
- 2023-12-29: disclosed
- 2023-12-29: patched: Fixed in miniflare@3.20231030.2