CVE-2022-31069: Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy
Summary
CVE-2022-31069: Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy. Affects @finastra/nestjs-proxy versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @finastra/nestjs-proxy and @ffdc/nestjs-proxy packages are NPM packages used in Node.js applications. They provide a proxy module for NestJS applications, allowing developers to easily configure and manage backend services. The packages enable the forwarding of requests to these services, including the forwarding of Authorization headers. However, prior to version 0.7.0 of @finastra/nestjs-proxy, there was no control over when Authorization headers should be forwarded, potentially exposing sensitive information such as OAuth bearer access tokens to unintended services.
Vulnerability Detail
The vulnerability in @finastra/nestjs-proxy and @ffdc/nestjs-proxy arises from the lack of control over the forwarding of Authorization headers. This could result in the inadvertent exposure of sensitive information to backend services that should not have access to it. For example, OAuth bearer access tokens could be exposed to services that should not see them, leading to unauthorized access and potential data breaches. The vulnerability has a CVSS score of 5.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
npm install @finastra/nestjs-proxy@0.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by updating their applications to use the patched version of @finastra/nestjs-proxy and configuring the 'forwardToken' setting to control the forwarding of Authorization headers.
Conclusion
In conclusion, the vulnerability in @finastra/nestjs-proxy and @ffdc/nestjs-proxy could result in the exposure of sensitive information to unintended backend services. Developers should update their applications to use version 0.7.0 of @finastra/nestjs-proxy and configure the 'forwardToken' setting to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @finastra/nestjs-proxy →
FAQ
The vulnerability could lead to the exposure of sensitive information, such as OAuth bearer access tokens, to backend services that should not have access to them. This could result in unauthorized access and potential data breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the vulnerability is present.
Yes, a fix is available in version 0.7.0 of @finastra/nestjs-proxy. Developers should update their applications to use this version to mitigate the vulnerability.
@ffdc/nestjs-proxy has been deprecated and is no longer maintained or receiving updates. It is recommended to update your package.json file to use @finastra/nestjs-proxy instead.
Developers can refer to the README file of @finastra/nestjs-proxy on Github or NPM for detailed instructions on how to configure the 'forwardToken' setting.
References
Related vulnerabilities
Recent vulnerabilities recorded for @finastra/nestjs-proxy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
