CVE-2023-34247: Open Redirect vulnerability in @keystone-6/auth
Summary
CVE-2023-34247: @keystone-6/auth Open Redirect vulnerability. Affects @keystone-6/auth versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @keystone-6/auth package is a component of the KeystoneJS framework, which is used for building scalable and efficient web applications. It provides authentication and authorization functionalities, allowing developers to easily manage user access and permissions. However, a vulnerability has been discovered in the package that could potentially lead to open redirects.
Vulnerability Detail
The vulnerability in @keystone-6/auth is an open redirect issue. It occurs when the redirect leading '/' filter can be bypassed, allowing users to be redirected to domains other than the relative host. This can be exploited by attackers to redirect users to unexpected locations, potentially leading to phishing attacks or other malicious activities.
How To Fix
Minimum fixed version
7.0.0
This is the first release that contains the fix.
npm install @keystone-6/auth@7.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the @keystone-6/auth package to the latest version to mitigate the risk.
Conclusion
The open redirect vulnerability in the @keystone-6/auth package can potentially lead to malicious redirects and phishing attacks. It is crucial to update to the latest version of the package (7.0.0 or higher) to mitigate this risk. For further support and assistance, you can reach out to the KeystoneJS team at security@keystonejs.com.
See every vulnerability recorded for @keystone-6/auth →
FAQ
An open redirect vulnerability occurs when a web application allows external input to control the destination of a redirect. Attackers can exploit this vulnerability to redirect users to malicious websites or phishing pages.
This vulnerability can be used by attackers to trick users into visiting malicious websites, leading to potential phishing attacks, malware infections, or unauthorized access to sensitive information.
There is no known exploit for this vulnerability at the moment. However, it is crucial to update the @keystone-6/auth package to the latest version to prevent any potential exploitation.
No, only versions prior to 7.0.0 are affected by this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
For further assistance or questions regarding this security advisory, you can contact the KeystoneJS team at security@keystonejs.com. They will be able to provide additional guidance and support.
References
Related vulnerabilities
Recent vulnerabilities recorded for @keystone-6/auth.
