Server-Side Request Forgery in ssrf-agent

ALTO 7.5CVE-2021-23718 · GHSA-6gww-qpm6-mc2g · Published 22/11/2021 · updated 17/06/2026

In breve

CVE-2021-23718 è una vulnerabilità ALTO (CVSS 7.5) che riguarda ssrf-agent (ssrf-agent project), ssrf-agent.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 76.2% delle vulnerabilità.
Correzione: aggiornare a 1.0.5 o successiva.

Package	Affected versions	Patched versions
ssrf-agent ssrf-agent_project	`< 1.0.5`	`1.0.5`
ssrf-agent npm	`< 1.0.5`	`1.0.5`

Description

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

NVD description

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.

References

nvd.nist.gov/vuln/detail/CVE-2021-23718 · ADVISORY
welefen/ssrf-agent commit 9607175 · WEB
welefen/ssrf-agent · PACKAGE
welefen/ssrf-agent · WEB
security.netapp.com/advisory/ntap-20211203-0005 · WEB
snyk.io/vuln/SNYK-JS-SSRFAGENT-1584362 · WEB
security.netapp.com/advisory/ntap-20211203-0005 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free