Platform
nodejs
Component
@nuxt/icon
Fixed in
1.4.6
1.4.5
CVE-2024-42352 describes a Server-Side Request Forgery (SSRF) vulnerability within the @nuxt/icon component, a popular tool for managing icons in Nuxt.js applications. This flaw allows attackers to manipulate the request path, potentially leading to unauthorized access to internal resources and sensitive data. The vulnerability impacts versions of @nuxt/icon before 1.4.5, and a patch has been released.
The SSRF vulnerability in @nuxt/icon arises from improper handling of the proxied request path within the /api/nuxticon/[name] endpoint. Attackers can exploit this by crafting malicious URLs that alter the request's scheme and host. This manipulation allows them to send requests to unintended internal services or external resources, potentially bypassing security controls. Successful exploitation could lead to the exposure of sensitive data, such as internal configuration files, database credentials, or even access to other internal systems. The blast radius extends to any internal resource accessible via HTTP or HTTPS from the server hosting the Nuxt.js application.
CVE-2024-42352 was publicly disclosed on August 5, 2024. There is currently no indication of active exploitation in the wild, nor is it listed on the CISA KEV catalog. Public proof-of-concept (PoC) code is not widely available, but the vulnerability's nature makes it relatively straightforward to exploit given access to a vulnerable application instance. The EPSS score is likely to be assessed as medium due to the ease of exploitation and potential impact.
Exploit Status
EPSS
0.08% (25% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-42352 is to upgrade to @nuxt/icon version 1.4.5 or later. This version includes a fix that properly validates and sanitizes the request path, preventing the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests with suspicious URL patterns, specifically those attempting to manipulate the scheme or host. Additionally, restrict network access from the Nuxt.js server to only necessary internal resources to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to craft a malicious URL designed to trigger the SSRF and verifying that the request is properly blocked.
Update the `@nuxt/icon` package to version 1.4.5 or higher. This will fix the SSRF vulnerability. Run `npm update @nuxt/icon` or `yarn upgrade @nuxt/icon` to update the package.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-42352 is a Server-Side Request Forgery vulnerability in the @nuxt/icon component, allowing attackers to manipulate request paths and potentially access internal resources.
Yes, if you are using @nuxt/icon versions prior to 1.4.5, you are vulnerable to this SSRF vulnerability.
Upgrade to @nuxt/icon version 1.4.5 or later to remediate the vulnerability. Consider WAF rules as a temporary workaround.
There is currently no public evidence of active exploitation, but the vulnerability's nature makes it easily exploitable.
Refer to the official @nuxt/icon release notes and GitHub repository for updates and advisories related to this vulnerability.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.