Insufficient Session Expiration in @cyyynthia/tokenize
Summary
GHSA-jcjx-c3j3-44pr: Insufficient Session Expiration in @cyyynthia/tokenize. Affects @cyyynthia/tokenize versions >= 1.1.0, < 1.1.3. Fixed in 1.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @cyyynthia/tokenize package is an npm package that provides token generation functionality. It is commonly used in web applications to generate and manage session tokens for user authentication and authorization. The package allows developers to generate unique tokens with expiration dates, ensuring that sessions are automatically invalidated after a certain period of time. However, a vulnerability was discovered in version 1.1.0 of the package, which caused tokens to be generated with faulty expiration dates. This vulnerability could potentially allow an attacker to use expired tokens to gain unauthorized access to protected resources.
Vulnerability Detail
The vulnerability in @cyyynthia/tokenize version 1.1.0 is due to a bug that resulted in the generation of tokens with NaN (Not a Number) as the expiration date. As a result, these tokens would not properly expire and would remain valid regardless of the lastTokenReset field. This means that even after the expected expiration time, the tokens would still be considered valid by the application. This could allow an attacker to use expired tokens to bypass session expiration and gain unauthorized access to protected resources. The issue was addressed in version 1.1.3 of the package, which includes a patch to invalidate the faulty tokens and ensure that new tokens behave as expected.
How To Fix
Minimum fixed version
1.1.3
This is the first release that contains the fix.
npm install @cyyynthia/tokenize@1.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The tokens generated by the @cyyynthia/tokenize package do not contain the necessary information to perform manual invalidation. Therefore, it is crucial to upgrade to version 1.1.3 or later to address the vulnerability.
Conclusion
The vulnerability in @cyyynthia/tokenize version 1.1.0 allows expired tokens to remain valid, potentially enabling attackers to bypass session expiration and gain unauthorized access to protected resources. To mitigate this vulnerability, it is crucial to upgrade to version 1.1.3 or later of the package. This upgrade will ensure that tokens are generated with correct expiration dates and that faulty tokens from previous versions are invalidated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @cyyynthia/tokenize →
FAQ
The vulnerability allows expired tokens to remain valid, potentially enabling attackers to bypass session expiration and gain unauthorized access to protected resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerable versions are detected.
There are no known exploits for this vulnerability at the time of this advisory. However, it is important to address the vulnerability promptly by upgrading to the fixed version of the @cyyynthia/tokenize package.
No, there is no CVE assigned to this vulnerability at the time of this advisory. However, it is still important to address the vulnerability by upgrading to the fixed version of the @cyyynthia/tokenize package.
This vulnerability was discovered and reported by the GitHub Security Lab. The issue was responsibly disclosed to the package maintainer, who promptly addressed the vulnerability in version 1.1.3 of the @cyyynthia/tokenize package.
