CVE-2024-42352— Server-Side Request Forgery (SSRF) in nuxt-icon
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-42352
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Server-Side Request Forgery (SSRF) in nuxt-icon
Source: NVD (National Vulnerability Database)
Vulnerability Description
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon lookup. This endpoint is at `/api/_nuxt_icon/[name]`. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure. The `new URL` constructor is used to parse the final path. This constructor can be passed a relative scheme or path in order to change the host the request is sent to. This constructor is also very tolerant of poorly formatted URLs. As a result we can pass a path prefixed with the string `http:`. This has the effect of changing the scheme to HTTP. We can then subsequently pass a new host, for example `http:127.0.0.1:8080`. This would allow us to send requests to a local server. This issue has been addressed in release version 1.4.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Nuxt 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Nuxt是Nuxt开源的一个免费的开源框架。 Nuxt 1.4.5之前版本存在安全漏洞，该漏洞源于代理请求路径解析不正确，允许攻击者更改请求的方案和主机，可能导致敏感数据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-42352
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-42352
请登录查看更多情报信息。
- https://github.com/nuxt/icon/security/advisories/GHSA-cxgv-px37-4mp2x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2024-42352
Same Patch Batch · nuxt · 2024-08-05 · 4 CVEs total
| CVE-2024-23657 | 8.8 HIGH | Path Traversal: '../filedir' in Nuxt Devtools |
| CVE-2024-34344 | 8.8 HIGH | Remote code execution via the browser when running the test locally in nuxt |
| CVE-2024-34343 | 6.3 MEDIUM | Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt |
IV. Related Vulnerabilities
Same vendor: nuxt
- CVE-2025-59414
Nuxt Client-Side Path Traversal in Nuxt Island Payload Reviv - CVE-2025-27415
Nuxt allows DOS via cache poisoning with payload rendering r - CVE-2025-24361
Opening a malicious website while running a Nuxt dev server - CVE-2025-24360
Opening a malicious website while running a Nuxt dev server - CVE-2024-34344
Remote code execution via the browser when running the test
Same weakness: CWE-918
- CVE-2026-8725
CoreWorxLab CAAL test-hass Endpoint webhooks.py server-side - CVE-2026-45338
Open WebUI: SSRF via OAuth Profile Picture URL in _process_p - CVE-2026-45347
Open WebUI: Blind server side request forgery (SSRF) via the - CVE-2026-45400
Open WebUI: Server-Side Request Forgery (SSRF) bypass in `va - CVE-2026-45401
Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-F
V. Comments for CVE-2024-42352
No comments yet