CVE-2019-14772: Cross-Site Scripting (XSS) in Verdaccio
Summary
CVE-2019-14772: Cross-Site Scripting (XSS) in Verdaccio. Affects verdaccio versions < 3.12.0. Fixed in 3.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Verdaccio is an open-source package registry for the npm ecosystem. It allows users to host their own private npm registry and manage packages. The vulnerability in Verdaccio allows for Cross-Site Scripting (XSS) attacks, where malicious packages containing JavaScript code can be executed in the user interface, potentially leading to the theft of user credentials.
Vulnerability Detail
The vulnerability in Verdaccio is classified as Cross-Site Scripting (XSS). It occurs when malicious packages with JavaScript content are executed in the user interface, enabling attackers to steal user credentials. This vulnerability can have serious consequences, as it allows unauthorized access to sensitive information and can lead to further exploitation of the system.
How To Fix
Minimum fixed version
3.12.0
This is the first release that contains the fix.
npm install verdaccio@3.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Users must update their Verdaccio installation to the recommended versions to mitigate the risk of XSS attacks.
Conclusion
In conclusion, the vulnerability in Verdaccio allows for Cross-Site Scripting (XSS) attacks, which can result in the theft of user credentials. To mitigate this risk, users should upgrade their Verdaccio installation to version 3.12.0 or higher, or migrate to a major version equal to or greater than 4.0.0. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for verdaccio →
FAQ
The vulnerability allows for Cross-Site Scripting (XSS) attacks, which can lead to the theft of user credentials and unauthorized access to sensitive information.
Yes, the vulnerability has been patched in Verdaccio versions 3.12.0 and higher, as well as major versions equal to or greater than 4.0.0.
No, users must upgrade their Verdaccio installation to the recommended versions to fix the vulnerability.
You can find more information about this vulnerability in the NPMJS Security Team advisories:
- Advisory 832: https://www.npmjs.com/advisories/832
- Advisory 833: https://www.npmjs.com/advisories/833
The vulnerability was reported by the NPMJS Security Team.
