Executive brief
deco-cx apps is a component library for building web applications. A vulnerability in the AnalyticsScript parameter handler allows remote attackers to manipulate the URL parameter, enabling server-side request forgery (SSRF) attacks. An attacker could trick the server into making unauthorized requests to internal or external systems, potentially exposing sensitive data or compromising backend infrastructure.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the AnalyticsScript function within the website/loaders/analyticsScript.ts file of the Parameter Handler component. The vulnerability stems from insufficient validation of the url parameter, allowing an attacker to supply arbitrary URLs that the server will request on their behalf. The attack is remotely exploitable and does not require authentication. An attacker can leverage this to probe internal networks, access metadata services, or perform attacks against backend systems. The vulnerability is addressed in version 0.120.2, which removes the affected proxy functionality.
Affected products
- deco-cx apps up to 0.120.1
Timeline
- 2025-12-01: disclosed: CVE-2025-13796 published
- 2025-09-01: patched: Version 0.120.2 released with fix (drop proxy)