PT-2023-32863 · Miniflare · Miniflare

Lekensteyn · Published 2023-12-29 · Updated 2024-01-05 · CVE-2023-7078

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Miniflare versions prior to 3.20231030.2

Description Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces, as was the default in wrangler until 3.19.0, an attacker on the local network could access other local servers.

Recommendations For versions prior to 3.20231030.2, update to version 3.20231030.2 or later to resolve the issue. As a temporary workaround, ensure Miniflare is configured to listen on just local interfaces by using the host: "127.0.0.1" option.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-7078

GHSA-FWVG-2739-22V7

Affected Products

Miniflare

References · 13

• https://github.com/cloudflare/workers-sdk/pull/4532 · Patch
• https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 · Patch
• https://osv.dev/vulnerability/GHSA-fwvg-2739-22v7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7078 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7078 · Vendor Advisory
• https://github.com/cloudflare/workers-sdk · Note
• https://t.me/cvenotify/66437 · Telegram Post
• https://t.me/cibsecurity/73964 · Telegram Post
• https://twitter.com/RedPacketSec/status/1742486839166935342 · Twitter Post
• https://twitter.com/CVEnew/status/1740710596524532007 · Twitter Post
• https://t.me/cvenotify/66439 · Telegram Post
• https://twitter.com/vuldb/status/1741061836236292559 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1740728534165794859 · Twitter Post