PT-2023-32863 · Miniflare · Miniflare

Lekensteyn · Publicado 2023-12-29 · Atualizado 2024-01-05 · CVE-2023-7078

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Miniflare versions prior to 3.20231030.2

Description Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces, as was the default in wrangler until 3.19.0, an attacker on the local network could access other local servers.

Recommendations For versions prior to 3.20231030.2, update to version 3.20231030.2 or later to resolve the issue. As a temporary workaround, ensure Miniflare is configured to listen on just local interfaces by using the host: "127.0.0.1" option.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-7078

GHSA-FWVG-2739-22V7

Produtos afetados

Miniflare

Referências · 13

• https://github.com/cloudflare/workers-sdk · Nota
• https://github.com/cloudflare/workers-sdk/pull/4532 · Correção
• https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 · Correção
• https://t.me/cvenotify/66437 · Publicação no Telegram
• https://t.me/cibsecurity/73964 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-fwvg-2739-22v7 · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/1742486839166935342 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1740710596524532007 · Publicação no Twitter
• https://t.me/cvenotify/66439 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-7078 · Nota de Segurança
• https://twitter.com/vuldb/status/1741061836236292559 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-7078 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1740728534165794859 · Publicação no Twitter