Server-Side Request Forgery in ssrf-agent

HOCH 7.5CVE-2021-23718 · GHSA-6gww-qpm6-mc2g · Published 22/11/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-23718 ist eine Schwachstelle (HOCH (CVSS 7.5)) in ssrf-agent (ssrf-agent project), ssrf-agent.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.6%, höher als bei 76.2% aller Schwachstellen.
Abhilfe: auf 1.0.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
ssrf-agent ssrf-agent_project	`< 1.0.5`	`1.0.5`
ssrf-agent npm	`< 1.0.5`	`1.0.5`

Description

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

NVD description

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

References

nvd.nist.gov/vuln/detail/CVE-2021-23718 · ADVISORY
welefen/ssrf-agent commit 9607175 · WEB
welefen/ssrf-agent · PACKAGE
welefen/ssrf-agent · WEB
security.netapp.com/advisory/ntap-20211203-0005 · WEB
snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362 · WEB
security.netapp.com/advisory/ntap-20211203-0005 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free