ProxyScotch is vulnerable to a server-side Request Forgery (SSRF)
High severity
GitHub Reviewed
Published
May 3, 2022
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
May 1, 2022
Published to the GitHub Advisory Database
May 3, 2022
Reviewed
May 4, 2022
Last updated
Feb 1, 2023
ProxyScotch is a simple proxy server created for hoppscotch.io. The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.
References