Default Express middleware security check is ignored in production - @cubejs-backend/api-gateway
Summary
GHSA-4j6x-w426-6rc6: Default Express middleware security check is ignored in production. Affects @cubejs-backend/api-gateway versions >= 0.11.0, < 0.11.17. Fixed in 0.11.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @cubejs-backend/api-gateway package is a part of the Cube.js framework, which is used for building analytical applications. It provides an API gateway for handling authentication and authorization in Cube.js deployments. The package utilizes the Express middleware for handling authentication.
Vulnerability Detail
The default Express middleware security check in @cubejs-backend/api-gateway is ignored in production environments. This means that all Cube.js deployments using affected versions of the package are vulnerable. The impact of this vulnerability is that unauthorized users may be able to bypass the authentication middleware and gain access to sensitive data or perform unauthorized actions. The vulnerability was fixed in version 0.11.17 of the package.
How To Fix
Minimum fixed version
0.11.17
This is the first release that contains the fix.
npm install @cubejs-backend/api-gateway@0.11.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the @cubejs-backend/api-gateway package is not possible, a workaround is available. The default authentication express middleware can be overridden by following the instructions provided in the Cube.js documentation: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware
Conclusion
The @cubejs-backend/api-gateway package is vulnerable to a security issue where the default Express middleware security check is ignored in production environments. This can potentially allow unauthorized access to sensitive data. Cube.js deployments should update to version 0.11.17 or later of the package to fix this vulnerability. If updating is not possible, a workaround is available by overriding the default authentication express middleware. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @cubejs-backend/api-gateway →
FAQ
The impact of this vulnerability is that unauthorized users may be able to bypass the authentication middleware and gain access to sensitive data or perform unauthorized actions.
To fix this vulnerability, Cube.js deployments should update to version 0.11.17 or later of the @cubejs-backend/api-gateway package.
Yes, a workaround is available. The default authentication express middleware can be overridden by following the instructions provided in the Cube.js documentation.
For more information, you can open an issue in the Cube.js GitHub repository or reach out to the Cube.js community Slack.
The severity of this vulnerability is rated as HIGH.
References
Related vulnerabilities
Recent vulnerabilities recorded for @cubejs-backend/api-gateway.
