AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

CloudflareGHSA-fwvg-2739-22v7

Server-Side Request Forgery (SSRF) in Miniflare

Cloudflare

CVE-2023-7078 · Published Dec 29, 2023

High8.0
Fix: upgrade to 3.20231030.2 or later
GitHub advisory

Impact

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

Patches

The issue was fixed in miniflare@3.20231030.2.

Workarounds

Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the host: "127.0.0.1" option.

References

  • https://github.com/cloudflare/workers-sdk/pull/4532

Affected versions

PackageAffectedFixed in
miniflare
npm
>= 3.20230821.0, < 3.20231030.23.20231030.2
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-918

More Cloudflare advisories

All Cloudflare
High 8.1Jan 29, 2024Information disclosure of Cloudflare API for low privileged usersCVE-2024-0212fixed in 4.12.3HighJan 8, 2024Kyber: timing side-channel (kyberslash2)GHSA-9763-4f94-gfchfixed in 1.3.7High 8.5Dec 29, 2023Arbitrary remote code execution within `wrangler dev` Workers sandboxCVE-2023-7080fixed in 3.19.0 +1Medium 6.9Dec 29, 2023Arbitrary remote file read in Wrangler dev serverCVE-2023-7079fixed in 3.19.0Medium 5.3Dec 12, 2023Unbounded queuing of path validation messages in cloudflare-quicheCVE-2023-6193fixed in 0.19.1Medium 5.3Dec 5, 2023Resource exhaustion via memory leak in tokio-boringCVE-2023-6180fixed in 4.1.0