CVE-2022-24717: Cross Site Scripting (XSS) in @finastra/ssr-pages
Summary
CVE-2022-24717: Cross Site Scripting (XSS) in @finastra/ssr-pages. Affects @finastra/ssr-pages versions < 0.1.5. Fixed in 0.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @finastra/ssr-pages package is an npm package used for server-side rendering (SSR) of pages. It provides functionality for building message pages with options like redirect links. This package is vulnerable to a cross-site scripting (XSS) issue when untrusted input is provided to the redirect.link property in the build(MessagePageOptions) function.
Vulnerability Detail
The vulnerability allows an attacker to inject malicious scripts into the redirect link, which can then be executed by unsuspecting users. This can lead to various consequences, such as stealing sensitive information, manipulating user sessions, or performing unauthorized actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.1.5
This is the first release that contains the fix.
npm install @finastra/ssr-pages@0.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the package as soon as possible.
Conclusion
In conclusion, the @finastra/ssr-pages package is vulnerable to a cross-site scripting (XSS) issue that can be exploited to execute arbitrary scripts in the user's browser. Users should upgrade to version 0.1.5 or later to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @finastra/ssr-pages →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to various malicious activities.
There is no known exploit at the moment, but it is important to patch the vulnerability to prevent any potential attacks.
No, only versions prior to 0.1.5 are affected. Users should upgrade to version 0.1.5 or later to mitigate the vulnerability.
There is no evidence of this vulnerability being exploited in the wild at the moment. However, it is always recommended to patch vulnerabilities as soon as possible to prevent any potential attacks.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-7f63-h6g3-7cwm/GHSA-7f63-h6g3-7cwm.json
References
Related vulnerabilities
Recent vulnerabilities recorded for @finastra/ssr-pages.
