CVE-2023-28155 — Server-Side Request Forgery in Request

Description

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	node-request	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	node-request	No fix yet	—
Ubuntu 22.04 LTS	node-request	No fix yet	—
Ubuntu 20.04 LTS	node-request	No fix yet	—
Ubuntu 18.04 LTS	node-request	No fix yet	—
Ubuntu 16.04 LTS	node-request	No fix yet	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 14.04 LTS	node-request	No fix yet	—

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	js-jquery	No fix yet	—
Azure Linux 2 (CBL-Mariner)	js-jquery	No fix yet	—
Azure Linux 2 (CBL-Mariner)	reaper	3.1.1-5	—

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	katib-earlystopping +8	0.19.0-r31	—
Wolfi rolling	katib-suggestion-goptuna-compat	0.19.0-r40	—
Wolfi rolling	kubeflow-centraldashboard	1.10.0-r7	—
Wolfi rolling	kubeflow-pipelines	2.14.3-r3	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	@cypress/request	< 3.0.0	3.0.0	GHSA-p8p7-x288-28g6
npm	request	<= 2.88.2	—	GHSA-p8p7-x288-28g6

Advisories 1

WID-SEC-2023-1800 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023

Server-Side Request Forgery in Request