CVE-2022-29229: Missing Cryptographic Step in cassproject
Summary
CVE-2022-29229: Missing Cryptographic Step in cassproject. Affects cassproject versions < 1.5.8. Fixed in 1.5.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cassproject is an npm package that provides a library for the CaSS (Competency and Skills System) project. It is used for storing and managing cryptographic keys in CaSS servers. The package is vulnerable to a missing cryptographic step when storing cryptographic keys, which can potentially grant unauthorized access to an account's cryptographic keys. This vulnerability affects CaSS servers that use standalone username/password authentication and expect end-to-end cryptographic security of authorization credentials.
Vulnerability Detail
The missing cryptographic step in cassproject allows a server administrator to gain access to an account's cryptographic keys. This can lead to unauthorized access to sensitive information and compromise the security of the system. The vulnerability has a CVSS score of 6.3, indicating a moderate severity level. The issue has been patched in version 1.5.8 of the cassproject package. However, the vulnerable accounts are only resecured when the user next logs in using standalone authentication, as the necessary data to resecure the account is not available to the server.
How To Fix
Minimum fixed version
1.5.8
This is the first release that contains the fix.
npm install cassproject@1.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to use SSO (Single Sign-On) or client-side certificates for authentication instead of standalone username/password authentication. However, it should be noted that SSO and client-side certificate authentication do not provide the same level of no-knowledge credential access, and the cryptographic keys will be accessible to the server administrator.
Conclusion
The cassproject package is vulnerable to a missing cryptographic step, which can allow a server administrator to access an account's cryptographic keys. It is recommended to update the package to version 1.5.8 or later to fix the vulnerability. Alternatively, using SSO or client-side certificates for authentication can mitigate the issue, although it comes with some trade-offs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cassproject →
FAQ
The vulnerability allows a server administrator to gain access to an account's cryptographic keys, potentially leading to unauthorized access to sensitive information.
To fix this vulnerability, update the cassproject package to version 1.5.8 or later.
Yes, using SSO or client-side certificates for authentication can mitigate the vulnerability. However, it should be noted that these methods do not provide the same level of no-knowledge credential access.
No, there are no references available at this time.
The vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
