CVE-2024-51753: @workos-inc/authkit-remix Refresh Tokens Logged in Debug Mode
Summary
CVE-2024-51753: @workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled. Affects @workos-inc/authkit-remix versions < 0.4.1. Fixed in 0.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @workos-inc/authkit-remix package is a library designed for authentication in Remix applications, providing features such as user login, session management, and token handling. It is widely used in web applications to streamline user authentication processes. However, a vulnerability exists when the debug flag is enabled, which can lead to sensitive information exposure.
Vulnerability Detail
The vulnerability arises from the logging of refresh tokens to the console when the debug flag, which is disabled by default, is turned on. This can lead to unauthorized access if an attacker gains access to the console output, potentially compromising user sessions and sensitive data. The issue is classified under CWE-532, which pertains to the exposure of sensitive information through log files.
How To Fix
Minimum fixed version
0.4.1
This is the first release that contains the fix.
npm install @workos-inc/authkit-remix@0.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid enabling the debug flag in production environments to prevent refresh tokens from being logged. Ensure that your application is configured to handle sensitive information securely.
Conclusion
The @workos-inc/authkit-remix package has a vulnerability that can expose refresh tokens when the debug flag is enabled. It is crucial to update to the patched version 0.4.1 to secure your application. Until then, avoid enabling the debug mode in production to protect sensitive information.
See every vulnerability recorded for @workos-inc/authkit-remix →
FAQ
The vulnerability can lead to the exposure of refresh tokens in the console, which may allow attackers to hijack user sessions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
No, the debug flag is disabled by default, which means the vulnerability is not active unless explicitly enabled.
If you cannot update the package, ensure that the debug flag remains disabled in your production environment to mitigate the risk.
More information can be found in the GitHub advisory and the release notes for the patched version of the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for @workos-inc/authkit-remix.
