CVE-2021-23718: Server-Side Request Forgery (SSRF)

November 22, 2021 (updated December 15, 2021)

The package ssrf-agent is vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

References

github.com/welefen/ssrf-agent/blob/cec2b85fe8886ad6926a247a3e059d8369ec022b/index.js%23L13
nvd.nist.gov/vuln/detail/CVE-2021-23718
snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362

Code Behaviors & Features

Detect and mitigate CVE-2021-23718 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →