CVE-2024-41813

CVSS V2 None CVSS V3 None

Description

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and prior to version 1.6.1, a Server-Side Request Forgery (SSRF) vulnerability in the `/proxy` route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network. Version 1.6.1 patches the issue.

Overview

CVE ID
CVE-2024-41813

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-07-26T16:51:33.606Z

Last Modified Date
2024-07-26T17:12:32.566Z

Weakness Enumerations

CWE	URL
CWE-918	http://cwe.mitre.org/data/definitions/918.html

References

Reference URL	Reference Tags
https://github.com/TxtDot/txtdot/security/advisories/GHSA-4c78-229v-hf6m	x_refsource_CONFIRM
https://github.com/TxtDot/txtdot/commit/f241a46e05b148a39b84bf956051b5aaa489949e	x_refsource_MISC
https://github.com/TxtDot/txtdot/blob/a7fdaf80fdf45abefe83b2eb5135ba112142dc74/src/handlers/distributor.ts#L43-L47	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-41813
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41813

History

Created	Old Value	New Value	Data Type	Notes
2024-07-27 13:04:50				Added to TrackCVE