Server-Side Request Forgery (SSRF) Affecting miniflare package, versions >=3.20230821.0 <3.20231030.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MINIFLARE-6140499
- published 31 Dec 2023
- disclosed 29 Dec 2023
- credit Lekensteyn
Introduced: 29 Dec 2023
CVE-2023-7078 Open this link in a new tabHow to fix?
Upgrade miniflare to version 3.20231030.2 or higher.
Overview
miniflare is a Fun, full-featured, fully-local simulator for Cloudflare Workers
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via specially crafted HTTP and WebSocket requests to the server. An attacker can access other local servers, by sending arbitrary requests from the server by accessing it when configured to listen on external network interfaces.
Workaround
Ensure Miniflare is configured to listen on just local interfaces. This is the default behaviour, but can also be configured with the host: "127.0.0.1" option.