Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon lookup. This endpoint is at `/api/_nuxt_icon/[name]`. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure. The `new URL` constructor is used to parse the final path. This constructor can be passed a relative scheme or path in order to change the host the request is sent to. This constructor is also very tolerant of poorly formatted URLs. As a result we can pass a path prefixed with the string `http:`. This has the effect of changing the scheme to HTTP. We can then subsequently pass a new host, for example `http:127.0.0.1:8080`. This would allow us to send requests to a local server. This issue has been addressed in release version 1.4.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Nuxt Icon versions prior to 1.4.5 are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs in the icon fetching functionality. An attacker can exploit this vulnerability by providing a malicious URL that points to an internal or restricted resource, potentially leading to unauthorized access or data exfiltration.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.
    `nuxt/icon` provides an API to allow client side icon lookup. This endpoint is at
    `/api/_nuxt_icon/[name]`. The proxied request path is improperly parsed, allowing an attacker to change
    the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data
    exposure. The `new URL` constructor is used to parse the final path. This constructor can be passed a
    relative scheme or path in order to change the host the request is sent to. This constructor is also very
    tolerant of poorly formatted URLs. As a result we can pass a path prefixed with the string `http:`. This
    has the effect of changing the scheme to HTTP. We can then subsequently pass a new host, for example
    `http:127.0.0.1:8080`. This would allow us to send requests to a local server. This issue has been
    addressed in release version 1.4.5 and all users are advised to upgrade. There are no known workarounds
    for this vulnerability. (CVE-2024-42352)

ID	Name	Product	Family	Severity
114958	Nuxt Icon < 1.4.5 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	high
414175	SCA: security update for @nuxt/icon (GHSA-cxgv-px37-4mp2)	Tenable Cloud Security	SCA Checks	high
414175	SCA: security update for @nuxt/icon (GHSA-cxgv-px37-4mp2)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2024-42352

high

Tenable Plugins

high

high

high