CVE-2022-0355: Exposure of Sensitive Information in simple-get
Summary
CVE-2022-0355: Exposure of Sensitive Information in simple-get. Affects simple-get across 3 version ranges.
< 2.8.2
>= 3.0.0, < 3.1.1
>= 4.0.0, < 4.0.1
Fixed in 2.8.2, 3.1.1 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The simple-get package is an npm module used for fetching remote URLs. It provides a simple interface for making HTTP requests and handling responses. The package is widely used in Node.js applications for retrieving data from external sources. However, versions prior to 4.0.1, 3.1.1, and 2.8.2 are vulnerable to an exposure of sensitive information.
Vulnerability Detail
The vulnerability in simple-get arises when fetching a remote URL with a cookie location response. In such cases, headers are followed, which can potentially lead to the exposure of the session cookie to a third party. This can have severe consequences as it allows unauthorized access to the user's session and sensitive information. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.8.22.8.2npm install simple-get@2.8.2 -
>= 3.0.0, < 3.1.13.1.1npm install simple-get@3.1.1 -
>= 4.0.0, < 4.0.14.0.1npm install simple-get@4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the simple-get package to the fixed versions mentioned above.
Conclusion
The exposure of sensitive information vulnerability in simple-get can have severe consequences, allowing unauthorized access to user sessions and sensitive data. It is crucial to update the package to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for simple-get →
FAQ
The vulnerability allows an attacker to access the user's session cookie and potentially gain unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
No, only versions prior to 4.0.1, 3.1.1, and 2.8.2 are affected. It is recommended to update to these fixed versions to mitigate the vulnerability.
No, there is no known workaround. Updating the simple-get package to the fixed versions is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
