CVE-2021-23664: Server side request forgery in @isomorphic-git/cors-proxy

January 21, 2022 (updated January 28, 2022)

The package @isomorphic-git/cors-proxy is vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

References

github.com/advisories/GHSA-v82v-rq72-phq9
github.com/isomorphic-git/cors-proxy/commit/1b1c91e71d946544d97ccc7cf0ac62b859e03311
nvd.nist.gov/vuln/detail/CVE-2021-23664
snyk.io/vuln/SNYK-JS-ISOMORPHICGITCORSPROXY-1734788

Code Behaviors & Features

Detect and mitigate CVE-2021-23664 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →