CVE-2024-42352
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Nuxt Icon's API endpoint. Attackers can manipulate the proxied request path to redirect requests to arbitrary hosts, potentially accessing internal services or sensitive data. All Nuxt applications using the vulnerable nuxt/icon module versions are affected.
💻 Affected Systems
- nuxt/icon
📦 What is this software?
Nuxt by Nuxt
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network services, data exfiltration from internal APIs, or chaining with other vulnerabilities for further exploitation.
Likely Case
Unauthorized access to internal HTTP services, port scanning of internal networks, or accessing metadata services in cloud environments.
If Mitigated
Limited impact due to network segmentation, but still potential for information disclosure about internal services.
🎯 Exploit Status
The vulnerability is well-documented in the security advisory with clear exploitation examples.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.5
Vendor Advisory: https://github.com/nuxt/icon/security/advisories/GHSA-cxgv-px37-4mp2
Restart Required: Yes
Instructions:
1. Update package.json to use nuxt/icon version 1.4.5 or higher. 2. Run npm update @nuxt/icon or yarn upgrade @nuxt/icon. 3. Restart the Nuxt application.
🔧 Temporary Workarounds
Disable nuxt/icon module
allRemove or disable the nuxt/icon module if not required
Remove @nuxt/icon from package.json dependencies
Remove nuxt/icon from nuxt.config.js modules array
🧯 If You Can't Patch
- Implement network-level restrictions to block outbound HTTP requests from the application server
- Deploy a WAF with SSRF protection rules to filter malicious requests to the /api/_nuxt_icon/ endpoint
🔍 How to Verify
Check if Vulnerable:
Check package.json for @nuxt/icon version. If version is below 1.4.5, the system is vulnerable.Check Version:
npm list @nuxt/icon | grep @nuxt/iconVerify Fix Applied:
Verify @nuxt/icon version is 1.4.5 or higher in package.json and node_modules/@nuxt/icon/package.json📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /api/_nuxt_icon/ endpoint with modified host parameters
- Outbound HTTP requests from application server to internal IP addresses
Network Indicators:
- HTTP requests from application server to unexpected internal services
- Port scanning activity originating from the application server
SIEM Query:
source="application_logs" AND path="/api/_nuxt_icon/*" AND (host!="expected_host" OR contains(host, "127.0.0.1") OR contains(host, "localhost"))