Executive brief
Nuxt Icon is a library that provides icon lookup through a web API. The icon lookup endpoint improperly validates URLs, allowing attackers to redirect requests to arbitrary servers. This can be exploited to access internal systems, cloud metadata services, or other sensitive resources not intended to be exposed.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in the /api/_nuxt_icon/[name] endpoint. The vulnerable code uses the JavaScript URL constructor to parse the proxied request path, which is overly lenient with malformed URLs. An attacker can inject a URL with an altered scheme and host (e.g., /api/_nuxt_icon/http:127.0.0.1:8080) to redirect the server-side request to an arbitrary target. No authentication or user interaction is required; the vulnerability is exploitable over the network. An attacker can exfiltrate sensitive data from internal services, cloud metadata endpoints, or other network-accessible resources. The fix is available in version 1.4.5 and later; affected versions are 1.4.4 and below. The vulnerability can be mitigated by disabling the fallbackToApi option.
Affected products
- Nuxt Icon <= 1.4.4
Timeline
- 2024-08-05: disclosed
- 2024-08-05: patched: version 1.4.5 released