Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2021-23664: isomorphic-git cors-proxy can be tricked to fetch internal URLs
CVE-2021-23664 · published 4 years ago
Summary
The isomorphic-git cors-proxy component may allow an attacker to make the server request any address, including internal network services, because it does not properly check the requested destination. This could expose private data or enable further attacks. Upgrade to version 2.7.1 or later, or apply a patch that adds proper validation of requested URLs.
What to do
- Update isomorphic-git cors-proxy to version 2.7.1.
- Update isomorphic-git @isomorphic-git/cors-proxy to version 2.7.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | isomorphic-git | cors-proxy |
< 2.7.1 Fix: upgrade to 2.7.1
|
| npm | isomorphic-git | @isomorphic-git/cors-proxy |
< 2.7.1 Fix: upgrade to 2.7.1
|
Original advisory text
Server side request forgery in @isomorphic-git/cors-proxy
The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23664
- https://github.com/advisories/GHSA-v82v-rq72-phq9
- https://github.com/isomorphic-git/cors-proxy Product
- https://github.com/isomorphic-git/cors-proxy/commit/1b1c91e71d946544d97ccc7cf0ac... Patch Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-ISOMORPHICGITCORSPROXY-1734788 Exploit Patch Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.5
High
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published21 Jan 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta