CVE-2022-0087: Reflected cross-site scripting (XSS) vulnerability in @keystone-6/auth
Summary
CVE-2022-0087: Reflected cross-site scripting (XSS) vulnerability. Affects @keystone-6/auth versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @keystone-6/auth package is a component of the Keystone 6 framework, which provides authentication capabilities for web applications. It is commonly used for managing user authentication and authorization in the administration user interface. However, this package is vulnerable to a reflected cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability allows an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package. This can occur when a user follows an untrusted link to the signin or init page in the administration user interface. The impact of this vulnerability can be significant, as it can be used in targeted attacks such as phishing or in conjunction with other vulnerabilities. The vulnerability has been assigned a CVSS score of 7.1, indicating a high severity level.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
npm install @keystone-6/auth@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade the dependencies, you can consider implementing one of the following workarounds:
- Disable the administration user interface.
- If using a reverse-proxy, strip query parameters when accessing the administration interface.
Conclusion
The @keystone-6/auth package is vulnerable to a reflected cross-site scripting (XSS) attack. To mitigate this vulnerability, it is recommended to upgrade to the latest version or apply the provided workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @keystone-6/auth →
FAQ
The vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of the user's browser, potentially leading to unauthorized actions or data theft.
To fix this vulnerability, upgrade to @keystone-6/auth version 1.0.2 or higher. If you are using @keystone-next/auth, upgrade to @keystone-6. Alternatively, disable the administration user interface or strip query parameters when accessing it through a reverse-proxy.
Yes, if you cannot upgrade the dependencies, you can disable the administration user interface or strip query parameters when accessing it through a reverse-proxy.
Yes, the vulnerability can be used in targeted attacks, including phishing, where an attacker tricks a user into following a malicious link that exploits the vulnerability.
Yes, the vulnerability has been assigned a CVSS score of 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @keystone-6/auth.
