CVE-2024-42352

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon lookup. This endpoint is at `/api/_nuxt_icon/[name]`. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure. The `new URL` constructor is used to parse the final path. This constructor can be passed a relative scheme or path in order to change the host the request is sent to. This constructor is also very tolerant of poorly formatted URLs. As a result we can pass a path prefixed with the string `http:`. This has the effect of changing the scheme to HTTP. We can then subsequently pass a new host, for example `http:127.0.0.1:8080`. This would allow us to send requests to a local server. This issue has been addressed in release version 1.4.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-918
• CWE-918

• https://github.com/nuxt/icon/security/advisories/GHSA-cxgv-px37-4mp2Third Party Advisory

Published

Aug 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42347matrix-react-sdk is a react-based SDK for inserting a Matri…6.5
• CVE-2024-42348FOG is a cloning/imaging/rescue suite/inventory management s…8.6
• CVE-2024-42349FOG is a cloning/imaging/rescue suite/inventory management s…5.3
• CVE-2024-4235A vulnerability classified as problematic was found in Netge…4.9
• CVE-2024-42350Biscuit is an authorization token with decentralized verific…3
• CVE-2024-42351Galaxy is a free, open-source system for analyzing data, aut…9.1
• CVE-2024-42353WebOb provides objects for HTTP requests and responses. When…6.1
• CVE-2024-42354Shopware is an open commerce platform. The store-API works w…5.9
• CVE-2024-42355Shopware, an open ecommerce platform, has a new Twig Tag `sw…9.8
• CVE-2024-42356Shopware is an open commerce platform. Prior to versions 6.6…7.2
• CVE-2024-42357Shopware is an open commerce platform. Prior to versions 6.6…9.8
• CVE-2024-42358PDFio is a simple C library for reading and writing PDF file…5.5