Server-side Request Forgery (SSRF)

2022-01-0504:31:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

ssrf

vulnerability

ipv4-mapped

request.js

cloud ip addresses

EPSS

0.003

Percentile

66.0%

JSON

uppy is vulnerable to server-side request forgery. The vulnerability exists in the isPrivateIP function in request.js as it does not properly check IPv4-mapped IPv6 addresses when it contains a double colon in front of the IP address (example: ::ffff:7f00:2), allowing an attacker to send requests on behalf of the server into any IP address, including private and cloud IP addresses.