CVE-2020-36851: cors-anywhere vulnerable to server-side request forgery

The vulnerability, CVE-2020-36851, is a Server-Side Request Forgery (SSRF) in cors-anywhere. The root cause is not a specific bug, but the inherent design of the package when deployed as an open proxy without proper security configurations. The package is designed to proxy requests to any URL, and in its default configuration, it lacks restrictions on the target of these requests.

My analysis focused on identifying the core functions responsible for this proxying behavior, as these are the functions that would be exploited. By examining the code and the discussions in the associated GitHub issues (particularly issue #78, which discusses mitigating this SSRF), I pinpointed the request handling flow.

1. The process begins in the anonymous function returned by getHandler in lib/cors-anywhere.js. This function acts as the main request handler. It extracts the target URL from the path of the incoming request. This is the entry point for the user-controlled, malicious input.

2. This handler then calls the proxyRequest function, passing along the parsed URL.

3. The proxyRequest function takes this URL and uses it to configure the http-proxy, setting the URL as the target of the outbound request. It then initiates the request using proxy.web().

At no point in this default flow is the target URL validated to ensure it does not point to internal services, cloud metadata endpoints, or other sensitive resources. This allows an attacker to craft a request to the cors-anywhere instance that causes the server to make a request to an arbitrary internal system.

The identified functions, getHandler.anonymous and proxyRequest, are therefore the key runtime indicators of this vulnerability. When this SSRF is exploited, these functions would appear in a stack trace or profiler output as they are directly involved in processing the malicious request and making the outbound connection.