Server-Side Request Forgery in ssrf-agent

ÉLEVÉE 7.5CVE-2021-23718 · GHSA-6gww-qpm6-mc2g · Published 22/11/2021 · updated 17/06/2026

En bref

CVE-2021-23718 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant ssrf-agent (ssrf-agent project), ssrf-agent.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.6%, plus élevée que 76.2% des vulnérabilités.
Correctif : mettre à jour vers 1.0.5 ou plus récent.

Package	Affected versions	Patched versions
ssrf-agent ssrf-agent_project	`< 1.0.5`	`1.0.5`
ssrf-agent npm	`< 1.0.5`	`1.0.5`

Description

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

NVD description

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

References

nvd.nist.gov/vuln/detail/CVE-2021-23718 · ADVISORY
welefen/ssrf-agent commit 9607175 · WEB
welefen/ssrf-agent · PACKAGE
welefen/ssrf-agent · WEB
security.netapp.com/advisory/ntap-20211203-0005 · WEB
snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362 · WEB
security.netapp.com/advisory/ntap-20211203-0005 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free