CVE-2021-28458: Improper Privilege Management in Azure ms-rest-nodeauth
Summary
CVE-2021-28458: Improper Privilege Management in Azure ms-rest-nodeauth. Affects @azure/ms-rest-nodeauth versions < 3.0.8. Fixed in 3.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Azure ms-rest-nodeauth library is an npm package that provides authentication and authorization functionality for Azure services in Node.js applications. It allows developers to authenticate and authorize their applications to access Azure resources. This library is widely used in various Node.js applications that interact with Azure services. However, a vulnerability has been discovered in versions 3.0.7 and earlier of the library, which could lead to an elevation of privilege.
Vulnerability Detail
The vulnerability in the Azure ms-rest-nodeauth library is due to improper privilege management. An attacker with limited privileges could exploit this vulnerability to gain elevated privileges and perform unauthorized actions. This could potentially lead to unauthorized access to sensitive data, modification of data, or disruption of services. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.0.8
This is the first release that contains the fix.
npm install @azure/ms-rest-nodeauth@3.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the library to the fixed version as soon as possible.
Conclusion
The Azure ms-rest-nodeauth library is vulnerable to an elevation of privilege vulnerability. It is crucial for developers to update their applications to use version 3.0.8 or later of the library to mitigate this vulnerability. Regularly checking for vulnerabilities using tools like Vulert can help ensure the security of your applications.
See every vulnerability recorded for @azure/ms-rest-nodeauth →
FAQ
The vulnerability could allow an attacker to gain elevated privileges and perform unauthorized actions, potentially leading to unauthorized access to sensitive data or disruption of services.
Versions 3.0.7 and earlier of the library are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, a fix is available in version 3.0.8 of the Azure ms-rest-nodeauth library. It is recommended to update to this version or later to mitigate the vulnerability.
For further support on vulnerability remediation, you can contact info@devnack.com.
