Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ocmd4LTdqNnYteGo4Ms0hSw

Reflected cross-site scripting (XSS) vulnerability

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package.

Impact

The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init page.
This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.

Vulnerability mitigation

Please upgrade to @keystone-6/auth >= 1.0.2, where this vulnerability has been closed.
If you are using @keystone-next/auth, we strongly recommend you upgrade to @keystone-6.

Workarounds

If for some reason you cannot upgrade the dependencies in software, you could alternatively

• disable the administration user interface, or
• if using a reverse-proxy, strip query parameters when accessing the administration interface

References

https://owasp.org/www-community/attacks/xss/

Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability

Permalink: https://github.com/advisories/GHSA-hrgx-7j6v-xj82
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocmd4LTdqNnYteGo4Ms0hSw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Identifiers: GHSA-hrgx-7j6v-xj82, CVE-2022-0087
References:

• https://github.com/keystonejs/keystone/security/advisories/GHSA-hrgx-7j6v-xj82
• https://nvd.nist.gov/vuln/detail/CVE-2022-0087
• https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38
• https://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e
• https://github.com/advisories/GHSA-hrgx-7j6v-xj82

Repository: https://github.com/keystonejs/keystone
Blast Radius: 16.1

Affected Packages