CVE-2021-32624: Private Field data leak in @keystonejs/keystone
Summary
CVE-2021-32624: Private Field data leak. Affects @keystonejs/keystone versions < 19.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @keystonejs/keystone package is an open-source framework for building database-driven websites, APIs, and applications. It provides a set of tools and APIs to simplify the development process and manage data models. The package allows developers to define schemas and access controls for their data fields, including private fields that should not be accessible to unauthorized users.
Vulnerability Detail
This security advisory addresses a vulnerability in the @keystonejs/keystone package that allows for the direct or indirect exposure of private field values, bypassing the configured access control. It is considered an access control related oracle attack, where an attacker can guide their attempt to reveal information they do not have access to. The complexity of the attack is limited by certain length-dependent behaviors and the fidelity of the exposed information.
Under specific circumstances, the values or metadata of private fields can be determined, even if the fields have 'read' access control configured. This vulnerability may impact users who utilize private fields or lists in their applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. Users are advised to follow the official updates and apply the recommended fix or workaround once it becomes available.
Conclusion
The @keystonejs/keystone package has been found to have a vulnerability that allows for the exposure of private field values, bypassing access control. The package maintainers are actively working on a fix or workaround. It is recommended to stay updated with the official GitHub repository and security advisories for further information. For additional support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @keystonejs/keystone →
FAQ
The vulnerability allows unauthorized access to private field values or metadata, potentially exposing sensitive information that should be protected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will provide real-time alerts for open-source vulnerabilities.
Currently, there are no known mitigations. It is recommended to apply the official fix or workaround once it is released.
Yes, this vulnerability can be exploited remotely as it is related to access control and can be targeted by malicious actors.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
