626 matches found
Server side request forgery (ssrf)
nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...
Stack overflow
nuxt-api-party is an open source module to proxy API requests. The library allows the user to send many options directly to ofetch. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directl...
nuxt-api-party Code Issues Vulnerabilities
nuxt-api-party is an open source module by Johann Schopplich Individual Developer for proxying API requests. A code issue vulnerability exists in nuxt-api-party version 0.21.3 and later, which stems from allowing a user to abuse the retry logic, causing the server to crash due to a stack overflow...
nuxt-api-party Code Issue Vulnerability
nuxt-api-party is an open source module by Johann Schopplich, an individual developer, for proxying API requests. A code issue vulnerability exists in nuxt-api-party version 0.21.3, which stems from lax URL detection, where absolute URLs with leading spaces can bypass this regular expression,...
CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party
nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...
CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party
nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...
CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party
nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...
CVE-2023-49799
The CVE-2023-49799 entry concerns the nuxt-api-party module, where a regex-based absolute-URL check (^https?://) can be bypassed by absolute URLs with leading whitespace (e.g., a leading newline). This can allow requests to bypass the whitelist, enabling Server-Side Request Forgery (SSRF) and pot...
CVE-2023-49800
CVE-2023-49800 affects the nuxt-api-party module. The issue arises from passing unfiltered fetchOptions from the request body into ofetch, allowing an attacker to craft a URL and set excessively high retry values, triggering recursive error handling that leads to a stack overflow and DoS. A fix i...
CVE-2023-49800 Denial of service by abusing `fetchOptions.retry` in nuxt-api-party
nuxt-api-party is an open source module to proxy API requests. The library allows the user to send many options directly to ofetch. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directl...
CVE-2023-49800 Denial of service by abusing `fetchOptions.retry` in nuxt-api-party
nuxt-api-party is an open source module to proxy API requests. The library allows the user to send many options directly to ofetch. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directl...
CVE-2023-49800
creationtimestamp| type| source ---|---|--- 2023-12-08 23:22:29+00:00| published-proof-of-concept| https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-q6hx-3m4p-749h...
PT-2023-31357 · Unknown · Nuxt-Api-Party
Name of the Vulnerable Software and Affected Versions: nuxt-api-party versions prior to 0.22.1 Description: The issue arises from a recent change in the detection of absolute URLs, which is no longer sufficient to prevent Server-Side Request Forgery SSRF. The regular expression ^https?:// used to...
@angular-architects/build-angular (16.2.0-next.2), @angular-devkit/build-angular (>=16.1.0-next.2, <=16.2.0-rc.0) +9 more potentially affected by CVE-2023-3481 via critters (>=0.0.17, <=0.0.19)
critters NPM version =0.0.17, =16.1.0-next.2, =16.0.1-snapshot-1686757302683, =16.0.1-snapshot-1686757302683, =16.1.0-rc.0, =16.1.0-rc.0, =16.1.0-rc.0, =1.1.40, =3.0.0-next.18, =0.14.29, =0.14.47 Source cves: CVE-2023-3481 Source advisory: OSV:GHSA-CX3J-QQXJ-9597...
Leak Secret tokens by changing baseURL
Description nuxt-api-party allows developers to easily hook up APIs. You can configure API URLs and Credentials to be sent on requests. It is suggested in the documentation that this plugin is capable of handling sensitive data. There is a design flaw that could allow an attacker to extract priva...
Code Injection
nuxt is vulnerable to Code Injection. The vulnerability exists due to a lack of user input path validation in test-component-wrapper.ts which allows an attacker to inject and execute malicious code. Note that this vulnerability is only applicable if the server is ran on dev mode...
@neutron.co.id/pemasaran-modules (>=1.1.1-beta.3, <=1.4.0), nuxt-hydration (>=0.0.1, <=0.1.0) potentially affected by CVE-2023-3224 via nuxt (3.4.2)
nuxt NPM version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt and may be impacted: - @neutron.co.id/pemasaran-modules =1.1.1-beta.3, =0.0.1, =0.1.0 Source cves: CVE-2023-3224 Source advisory: OSV:GHSA-GC34-5V43-H7V8...
nuxt Code Injection vulnerability
he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly...
