Plataforma
nodejs
Componente
vriteio/vrite
Corrigido em
0.3.0
CVE-2023-5572 describes a critical Server-Side Request Forgery (SSRF) vulnerability discovered in the vriteio/vrite Node.js library. This flaw allows attackers to induce the server to make requests to unintended locations, potentially exposing sensitive internal resources or performing actions on behalf of the server. The vulnerability affects versions of vriteio/vrite prior to 0.3.0, and a patch has been released.
The SSRF vulnerability in vriteio/vrite poses a significant risk because it allows attackers to bypass security controls and access resources that should be inaccessible. An attacker could leverage this to scan internal networks, access cloud metadata services (potentially revealing credentials), or even interact with internal APIs. The impact can range from information disclosure to complete system compromise, depending on the resources accessible through the SSRF. This vulnerability is particularly concerning in environments where vriteio/vrite is used to process external data or interact with other services.
CVE-2023-5572 was publicly disclosed on 2023-10-13. While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity and ease of exploitation make it a high-priority target. No public proof-of-concept code has been released, but the SSRF nature of the vulnerability suggests that exploitation is relatively straightforward. The vulnerability is not currently listed on the CISA KEV catalog.
Applications and services that utilize the vriteio/vrite Node.js library, particularly those handling external data or interacting with internal APIs, are at risk. This includes projects relying on vriteio/vrite for data processing or integration with other services. Shared hosting environments where vriteio/vrite is a dependency of a larger application are also vulnerable.
• nodejs / server:
npm list vriteio/vrite• nodejs / server:
npm audit vriteio/vrite• nodejs / server: Check process arguments for suspicious URLs being passed to vriteio/vrite.
disclosure
Status do Exploit
EPSS
0.27% (percentil 50%)
Vetor CVSS
The primary mitigation for CVE-2023-5572 is to immediately upgrade to version 0.3.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting outbound network access for the vriteio/vrite process using a firewall or proxy, and carefully validating and sanitizing any URLs provided to the library. Monitor network traffic for unusual outbound requests originating from the vriteio/vrite process. After upgrading, confirm the fix by attempting to trigger an SSRF request and verifying that it is blocked.
Atualize a versão de vriteio/vrite para 0.3.0 ou superior. Esta versão corrige a vulnerabilidade SSRF. Você pode atualizar o pacote utilizando npm ou yarn de acordo com a configuração do seu projeto.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2023-5572 is a critical Server-Side Request Forgery (SSRF) vulnerability in the vriteio/vrite Node.js library, allowing attackers to make requests to unintended locations.
You are affected if you are using vriteio/vrite versions prior to 0.3.0. Check your project dependencies to determine if you are vulnerable.
Upgrade to vriteio/vrite version 0.3.0 or later. If immediate upgrade is not possible, implement temporary workarounds like restricting outbound network access.
While no active exploitation campaigns have been publicly confirmed, the CRITICAL severity makes it a high-priority target for attackers.
Refer to the vriteio GitHub repository for updates and advisories: https://github.com/vriteio/vrite
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.