// For flags

CVE-2023-7078

Server-Side Request Forgery (SSRF) in Miniflare

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

El envío de solicitudes HTTP especialmente manipuladas al Miniflare's server podría dar como resultado el envío de solicitudes HTTP y WebSocket arbitrarias desde el servidor. Si Miniflare estaba configurado para escuchar en interfaces de red externas (como era el valor predeterminado en Wrangler hasta 3.19.0), un atacante en la red local podría acceder a otros servidores locales.

Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.

*Credits: Peter Wu (Lekensteyn)
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Adjacent
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-12-22 CVE Reserved
  • 2023-12-29 CVE Published
  • 2024-08-26 CVE Updated
  • 2025-04-27 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
  • CAPEC-664: Server Side Request Forgery
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cloudflare
Search vendor "Cloudflare"
 Miniflare
Search vendor "Cloudflare" for product "Miniflare"
 >= 3.20230821.0 < 3.20231030.2
Search vendor "Cloudflare" for product "Miniflare" and version " >= 3.20230821.0 < 3.20231030.2"
node.js
Affected