[GHSA-p8p7-x288-28g6] Server-Side Request Forgery in Request

[G-Rath]

Updates

• Affected products

Comments
Mark fork of request as vulnerable

[shelbyc]

👋 Hi @G-Rath, thank you for bringing this fork and the discussions surrounding @cypress/request and CVE-2023-28155 to our attention. I'm going to show my colleagues the vulnerable code in request and the vulnerable code in @cypress/request. It would be interesting to see if we could replicate the proof of concept from the original report in the forked package.

In the meantime, I will avoid changing the advisory unless/until the maintainers of @cypress/request confirm that their fork is vulnerable or my colleagues and I are able to confirm the fork is vulnerable by some other means.

[shelbyc]

@G-Rath Good news! My colleague showed me that it was possible to reproduce the proof of concept from the original report in both request and @cypress/request. Because both packages are vulnerable, this contribution will be accepted.

[shelbyc]

@G-Rath There are some folks I work with to whom I sent notification of pending changes, but I'm not sure if they saw them because I let them know on a Friday afternoon. I didn't want to keep you in the dark about the status of the contribution longer than necessary, but because of the number of alerts that will go out and as a courtesy to those colleagues, I'm giving them until Monday morning to see the notification before the changes are merged.

[advisory-database]

Hi @G-Rath! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!