CVE-2024-42352

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. "nuxt/icon" provides an API to allow client side icon lookup. This endpoint is at "/api/nuxticon/name". The proxied request path is improperly parsed, allowing an attacker to change the scheme...

CVE-2024-42352: Server-Side Request Forgery (SSRF)

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...

Possible URL spoofing on wildcard path

Description H3 provides the getRequestURL utility using the new URLa, b constructor. When variable a is attacker-controlled the origin of the resulting URL can be modified. Proof of Concept js // index.js import listen from "listhen"; import createApp, createRouter, eventHandler, toNodeListener,...