CVE-2023-7078
📋 TL;DR
CVE-2023-7078 is a server-side request forgery (SSRF) vulnerability in Miniflare's development server that allows attackers to send arbitrary HTTP and WebSocket requests from the server. This affects users running Miniflare with default configurations that listen on external network interfaces, potentially exposing internal services to attackers on the same local network.
💻 Affected Systems
- Miniflare
- wrangler (Cloudflare Workers CLI)
📦 What is this software?
Miniflare by Cloudflare
⚠️ Risk & Real-World Impact
Worst Case
Attackers could pivot through the vulnerable server to access sensitive internal services, databases, or cloud metadata endpoints, potentially leading to data exfiltration or further network compromise.
Likely Case
Local network attackers could scan and interact with other internal services that shouldn't be externally accessible, potentially accessing development servers, databases, or administrative interfaces.
If Mitigated
If properly configured to listen only on localhost or behind proper network segmentation, the impact is limited to the local machine only.
🎯 Exploit Status
Exploitation requires network access to the vulnerable server and involves sending specially crafted HTTP requests
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: wrangler 3.19.0+
Vendor Advisory: https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7
Restart Required: Yes
Instructions:
1. Update wrangler to version 3.19.0 or later using npm update -g wrangler or your package manager. 2. Restart any running Miniflare development servers.
🔧 Temporary Workarounds
Bind to localhost only
allConfigure Miniflare to listen only on localhost instead of external interfaces
wrangler dev --host localhost
miniflare --host localhost
Use network firewall
allBlock external access to Miniflare's default port (8787) using host or network firewall
sudo ufw deny 8787
netsh advfirewall firewall add rule name="Block Miniflare" dir=in action=block protocol=TCP localport=8787
🧯 If You Can't Patch
- Configure Miniflare to bind only to 127.0.0.1/localhost instead of 0.0.0.0
- Place the development server behind a properly configured reverse proxy or VPN with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check if wrangler version is below 3.19.0 and Miniflare is listening on external interfaces (not just localhost)Check Version:
wrangler --versionVerify Fix Applied:
Verify wrangler version is 3.19.0+ and confirm Miniflare only listens on localhost when started📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to Miniflare server with crafted URLs pointing to internal addresses
- Outbound requests from Miniflare to unexpected internal services
Network Indicators:
- Traffic from Miniflare server to internal services not normally accessed
- SSRF patterns in HTTP requests to Miniflare
SIEM Query:
source="miniflare" AND (url="*://127.*" OR url="*://10.*" OR url="*://192.168.*" OR url="*://172.16.*")