CVE-2023-28155

MEDIUM

Request < 2.88.1 - Server-Side Request Forgery via Cross-Protocol Redirect

Title source: llm
STIX 2.1

Description

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References (4)

Core 4
Core References
Exploit, Patch, Technical Description, Third Party Advisory
https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
Exploit, Issue Tracking, Patch, Technical Description, Vendor Advisory
https://github.com/request/request/issues/3442

Scores

CVSS v3 6.1
EPSS 0.0056
EPSS Percentile 68.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-918
Status published
Products (3)
cypress/request 0 - 3.0.0npm
npm/request 0npm
request_project/request < 2.88.1
Published Mar 16, 2023
Tracked Since Feb 18, 2026