Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02bWhyLTUybXYtNnY2Zs4AAvaQ

Field-level access-control bypass for multiselect field

Impact

@keystone-6/[email protected] || 2.3.0 users who are using the multiselect field, and provided field-level access control - are vulnerable to their field-level access control not being used.

List-level access control is NOT affected.

Field-level access control for fields other than multiselect are NOT affected.

Example, you are vulnerable if you are using field-level access control on a multiselect like the following:

const yourList = list({
  access: {
    // this is list-level access control, this is NOT impacted
  },
  fields: {
    yourFieldName: multiselect({
      // this is field-level access control, for multiselect fields
      //   this is vulnerable
      access: {
        create: ({ session }) => session?.data.isAdmin,
        update: ({ session }) => session?.data.isAdmin,
      },
      options: [
        { value: 'apples', label: 'Apples' },
        { value: 'oranges', label: 'Oranges' },
      ],
      // ...
    }),
    // ...
  },
  // ...
});

Mitigation

Please upgrade to @keystone-6/core >= 2.3.1, where this vulnerability has been closed.

Workarounds

If for some reason you cannot upgrade your dependencies, you should stop using the multiselect field.

Credits

Thanks to Marek R for reporting and submitting the pull request to fix this problem.

If you have any questions around this security advisory, please don't hesitate to contact us at [email protected], or open an issue on GitHub.

If you have a security flaw to report for any software in this repository, please see our SECURITY policy.

Permalink: https://github.com/advisories/GHSA-6mhr-52mv-6v6f
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02bWhyLTUybXYtNnY2Zs4AAvaQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-6mhr-52mv-6v6f, CVE-2022-39322
References:

• https://github.com/keystonejs/keystone/security/advisories/GHSA-6mhr-52mv-6v6f
• https://nvd.nist.gov/vuln/detail/CVE-2022-39322
• https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7c
• https://github.com/advisories/GHSA-6mhr-52mv-6v6f

Repository: https://github.com/keystonejs/keystone
Blast Radius: 19.3

Affected Packages