CVE-2021-21421: ApiKey secret could be revealed on network issue in node-etsy-client
Summary
CVE-2021-21421: ApiKey secret could be revelated on network issue. Affects node-etsy-client versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-etsy-client is an npm package that provides a client for interacting with the Etsy API. It allows developers to easily integrate Etsy functionality into their applications. However, versions of node-etsy-client prior to v0.3.0 are vulnerable to a security issue that could result in the exposure of the API key secret. This vulnerability affects applications that use node-etsy-client and report client errors to end users.
Vulnerability Detail
The vulnerability in node-etsy-client allows the API key value to be exposed when reporting client errors to end users. This means that if an error occurs during a network issue, the error message may inadvertently include the API key secret. This could potentially lead to unauthorized access to the Etsy API and the compromise of sensitive data. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
0.3.0
This is the first release that contains the fix.
npm install node-etsy-client@0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a newer version is not immediately feasible, a temporary workaround is to avoid reporting or logging Etsy client errors when using node-etsy-client versions <= v0.2.0. By disabling error reporting, the risk of exposing the API key secret can be mitigated. However, it is strongly recommended to update to a patched version as soon as possible.
Conclusion
In conclusion, the vulnerability in node-etsy-client allows the API key secret to be exposed in error messages during network issues. To mitigate this vulnerability, it is crucial to update to node-etsy-client v0.3.0 or later. If immediate upgrading is not possible, disabling error reporting can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-etsy-client →
FAQ
Applications that use node-etsy-client and report client errors to end users are affected by this vulnerability.
The impact of this vulnerability is the potential exposure of the API key secret, which could lead to unauthorized access to the Etsy API and the compromise of sensitive data.
Yes, the vulnerability has been patched in node-etsy-client v0.3.0 and later versions.
Yes, a temporary workaround is to avoid reporting or logging Etsy client errors when using node-etsy-client versions <= v0.2.0. However, it is recommended to update to a patched version as soon as possible.
More information about this vulnerability can be found in the GitHub advisory: https://github.com/creharmony/node-etsy-client/issues/17
