CVE-2023-28155: Server-Side Request Forgery in Request

March 16, 2023 (updated November 7, 2023)

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability affects products that are no longer supported by the maintainer. The original request/request package is no longer updated. There are forks of the package which resolve this vulnerability.

References

doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
github.com/advisories/GHSA-p8p7-x288-28g6
github.com/request/request/issues/3143
github.com/request/request/issues/3442
github.com/request/request/pull/3444
nvd.nist.gov/vuln/detail/CVE-2023-28155

Code Behaviors & Features

Detect and mitigate CVE-2023-28155 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →