CVE-2016-10532: Authentication Bypass in console-io
Summary
CVE-2016-10532: Authentication Bypass in console-io. Affects console-io versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The console-io package is an npm package that provides terminal access on the server via a web page. It allows users to interact with the server's terminal remotely. This package is vulnerable to an authentication bypass vulnerability, which can lead to remote code execution. The vulnerability exists because affected versions of console-io do not configure the underlying websocket library to require authentication.
Vulnerability Detail
The authentication bypass vulnerability in console-io allows an attacker to bypass the authentication mechanism and gain unauthorized access to the server's terminal. This essentially allows remote code execution, as the attacker can execute arbitrary commands on the server. The vulnerability poses a significant risk to the security and integrity of the server and its data.
How To Fix
Minimum fixed version
2.3.0
This is the first release that contains the fix.
npm install console-io@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the console-io package to mitigate the risk.
Conclusion
The authentication bypass vulnerability in console-io allows unauthorized access to the server's terminal, leading to potential remote code execution. It is crucial to update to version 2.3.0 or later of the package to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for console-io →
FAQ
The vulnerability allows an attacker to bypass authentication and gain remote access to the server's terminal, leading to potential remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and alerts you in real-time for open-source vulnerabilities.
Yes, updating to version 2.3.0 or later of the console-io package fixes the vulnerability by configuring the underlying websocket library to require authentication.
There are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-q52j-4q2q-hcj6/GHSA-q52j-4q2q-hcj6.json
