search

fent / node-miniget

A small http(s) GET library.
MIT License
52 stars 17 forks source link

SSRF Vulnerability in request function #74

Closed LightYagami28 closed 3 days ago

LightYagami28 commented 2 weeks ago

Issue Description: A potential Server-Side Request Forgery (SSRF) vulnerability was detected in the miniget library. The issue was identified in the file index.js at line 170, where unsanitized input from the document location flows into a request.

Steps to Reproduce: This vulnerability was detected using Snyk Code analysis. The code in question does not adequately validate or sanitize the input, leading to a potential SSRF risk.

Suggested Fix: It is recommended to validate the input URL, potentially by implementing a whitelist of allowed domains or by sanitizing user input before making the request.

References:

LightYagami28 commented 2 weeks ago

Pls fix @fent

fent commented 2 weeks ago

The link doesn't work. what's the suggested fix for this?

LightYagami28 commented 2 weeks ago

New link: https://learn.snyk.io/lesson/ssrf-server-side-request-forgery/

fent commented 2 weeks ago

so the suggested fix is to not allow common internal domains such as localhost, 127.0.0.1, 192....., etc? although there could be a custom internal domain

i also looked at other http libraries like got, node-fetch, superagent, and request. only request mitigates around this by not allowing redirects for non-GET requests here