PT-2020-19971 · Uppy · Uppy+1

Published 2020-03-20 · Updated 2020-09-03 · CVE-2020-8135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions uppy versions prior to 1.9.3 @uppy/companion versions prior to 1.9.3

Description The issue allows an attacker to perform a Server-Side Request Forgery (SSRF) attack, enabling them to scan local or external networks or interact with internal systems. This is possible because the get route in @uppy/companion passes the user-controlled variable req.body.url to a GET request without proper sanitization, allowing attackers to inject arbitrary URLs and make GET requests on behalf of the server.

Recommendations For uppy versions prior to 1.9.3, upgrade to version 1.9.3 or later. For @uppy/companion versions prior to 1.9.3, upgrade to version 1.9.3 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-8135

GHSA-MM7R-265W-JV6F

Affected Products

@Uppy/Companion

Uppy

References · 5

• 🔥 https://hackerone.com/reports/786956 · Exploit
• https://osv.dev/vulnerability/GHSA-mm7r-265w-jv6f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8135 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8135 · Vendor Advisory
• https://npmjs.com/advisories/1501 · Note