CVE-2021-27884: Weak JSON Web Token in yapi-vendor
Summary
CVE-2021-27884: Weak JSON Web Token in yapi-vendor. Affects yapi-vendor versions < 1.9.3. Fixed in 1.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yapi-vendor package is an npm package used in YMFE YApi, a popular open-source project management platform. It provides various vendor dependencies for YApi's backend functionality. The package is responsible for generating JSON Web Tokens (JWT) for user authentication and authorization. However, versions of yapi-vendor up to 1.9.2 suffer from a weak JWT signing secret generation vulnerability. This vulnerability allows an attacker to recreate other users' JWT tokens due to the insecure randomness source used in the signing process. The vulnerability has been assigned a CVSS score of 5.1, indicating a moderate severity level.
Vulnerability Detail
The weak JSON Web Token (JWT) signing secret generation vulnerability in yapi-vendor arises from the usage of Math.random in Node.js as a source of randomness for JWT signing. Math.random does not provide cryptographically secure random numbers, making it possible for an attacker to recreate other users' JWT tokens. This can lead to unauthorized access, privilege escalation, and potential data breaches. The vulnerability has been patched in version 1.9.3 of yapi-vendor.
How To Fix
Minimum fixed version
1.9.3
This is the first release that contains the fix.
npm install yapi-vendor@1.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched version as soon as possible.
Conclusion
The weak JSON Web Token (JWT) signing secret generation vulnerability in yapi-vendor can lead to unauthorized access and potential data breaches. Users of yapi-vendor are advised to upgrade to version 1.9.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yapi-vendor →
FAQ
yapi-vendor is an npm package used in YMFE YApi for managing vendor dependencies and providing backend functionality.
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. It is commonly used for authentication and authorization purposes.
The vulnerability allows an attacker to recreate other users' JWT tokens, potentially leading to unauthorized access and data breaches.
Yes, the vulnerability has been patched in version 1.9.3 of yapi-vendor.
The vulnerability has been assigned a CVSS score of 5.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for yapi-vendor.
