CVE-2023-28155 (Medium) detected in request-2.88.0.tgz

[mend-bolt-for-github[bot]]

CVE-2023-28155 - Medium Severity Vulnerability

Vulnerable Library - request-2.88.0.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Dependency Hierarchy: - webpacker-4.0.7.tgz (Root Library) - node-sass-4.12.0.tgz - :x: **request-2.88.0.tgz** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here

[chatcody[bot]]

Based on the description, it seems that the Request package through version 2.88.1 for Node.js has a vulnerability (CVE-2023-28155) that allows a bypass of SSRF mitigations via an attacker-controlled server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). The vulnerability only affects products that are no longer supported by the maintainer.

To mitigate this vulnerability, we can update the Request package to a version that has fixed the issue. According to the vulnerability details, version 2.88.2 or later should be safe to use.

To update the package, we can run the following command in the terminal:

npm install request@latest

Alternatively, we can update the package.json file to specify the latest version of the Request package:

"dependencies": {
  "request": "^2.88.2"
}

After updating the package, we should test the application thoroughly to ensure that there are no compatibility issues or regressions.

If there are any concerns or questions about the vulnerability or the solution, please provide additional details.