Platform
nodejs
Component
vriteio/vrite
Fixed in
0.3.0
CVE-2023-5572 describes a critical Server-Side Request Forgery (SSRF) vulnerability discovered in the vriteio/vrite Node.js library. This flaw allows attackers to induce the server to make requests to unintended locations, potentially exposing sensitive internal resources or performing actions on behalf of the server. The vulnerability affects versions of vriteio/vrite prior to 0.3.0, and a patch has been released.
The SSRF vulnerability in vriteio/vrite poses a significant risk because it allows attackers to bypass security controls and access resources that should be inaccessible. An attacker could leverage this to scan internal networks, access cloud metadata services (potentially revealing credentials), or even interact with internal APIs. The impact can range from information disclosure to complete system compromise, depending on the resources accessible through the SSRF. This vulnerability is particularly concerning in environments where vriteio/vrite is used to process external data or interact with other services.
CVE-2023-5572 was publicly disclosed on 2023-10-13. While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity and ease of exploitation make it a high-priority target. No public proof-of-concept code has been released, but the SSRF nature of the vulnerability suggests that exploitation is relatively straightforward. The vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.27% (50% percentile)
CVSS Vector
The primary mitigation for CVE-2023-5572 is to immediately upgrade to version 0.3.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting outbound network access for the vriteio/vrite process using a firewall or proxy, and carefully validating and sanitizing any URLs provided to the library. Monitor network traffic for unusual outbound requests originating from the vriteio/vrite process. After upgrading, confirm the fix by attempting to trigger an SSRF request and verifying that it is blocked.
Update the version of vriteio/vrite to 0.3.0 or higher. This version fixes the SSRF vulnerability. You can update the package using npm or yarn according to your project configuration.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2023-5572 is a critical Server-Side Request Forgery (SSRF) vulnerability in the vriteio/vrite Node.js library, allowing attackers to make requests to unintended locations.
You are affected if you are using vriteio/vrite versions prior to 0.3.0. Check your project dependencies to determine if you are vulnerable.
Upgrade to vriteio/vrite version 0.3.0 or later. If immediate upgrade is not possible, implement temporary workarounds like restricting outbound network access.
While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity makes it a high-priority target for attackers.
Refer to the vriteio GitHub repository for updates and advisories: https://github.com/vriteio/vrite
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.