CVE-2022-1650: eventsource - Exposure of Sensitive Information in eventsource
Summary
CVE-2022-1650: Exposure of Sensitive Information in eventsource. Affects eventsource across 2 version ranges.
< 1.1.1
>= 2.0.0, < 2.0.2
Fixed in 1.1.1 or 2.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- node-eventsource · Debian:11
The same CVE-2022-1650 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The eventsource package is an npm package that provides a client-side EventSource implementation for browsers that do not support the native EventSource API. It allows developers to establish a persistent connection to a server and receive real-time updates. The package is widely used in web applications to enable server-sent events (SSE).
Vulnerability Detail
The vulnerability (CVE-2022-1650) in eventsource allows for the exposure of sensitive information. When fetching a URL with a link to an external site that triggers a redirect, the user's cookies and authorization headers are leaked to the third-party application. This violates the same-origin policy, which should sanitize the headers. The impact of this vulnerability is critical, as it can lead to unauthorized access to user data and potential account compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.11.1.1npm install eventsource@1.1.1 -
>= 2.0.0, < 2.0.22.0.2npm install eventsource@2.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the eventsource package to the fixed versions as soon as possible.
Conclusion
The eventsource package is vulnerable to the exposure of sensitive information, which can lead to unauthorized access and potential account compromise. It is crucial to update to the fixed versions (1.1.1 or higher for npm ecosystem, 2.0.2 or higher for npm ecosystem) to mitigate this vulnerability. If you are unsure whether your application is affected, you can use Vulert's playground (https://vulert.com/scanner) to check. For additional support and guidance, please reach out to DevNack.com.
See every vulnerability recorded for eventsource →
FAQ
The impact of this vulnerability is critical, as it can lead to unauthorized access to user data and potential account compromise.
To fix this vulnerability, update the eventsource package to version 1.1.1 or higher for npm ecosystem or version 2.0.2 or higher for npm ecosystem.
There is no known workaround for this vulnerability. It is recommended to update the eventsource package to the fixed versions.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
For further support on vulnerability remediation, you can contact info@devnack.com.
