Machine-In-The-Middle Vulnerability in airtable
Summary
GHSA-jrj9-5qp6-2v8q: Machine-In-The-Middle in airtable. Affects airtable versions >= 0.1.19, < 0.7.2. Fixed in 0.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Airtable is an npm package that provides a convenient way to interact with the Airtable API. It allows users to create, read, update, and delete records in Airtable databases. However, versions of the airtable package prior to 0.7.2 are vulnerable to a Machine-In-The-Middle (MITM) attack. This vulnerability is due to SSL certificate validation being disabled by default, which unintentionally allows attackers in a privileged network position to decrypt intercepted traffic.
Vulnerability Detail
The Machine-In-The-Middle vulnerability in airtable arises from the package's SSL certificate validation being disabled by default. This means that when making requests to the Airtable API, the package does not verify the authenticity of the SSL certificate presented by the server. As a result, an attacker who is in a privileged network position can intercept the traffic between the client and the server, decrypt it, and potentially gain access to sensitive information. This vulnerability poses a significant risk to the confidentiality and integrity of data transmitted through airtable.
How To Fix
Minimum fixed version
0.7.2
This is the first release that contains the fix.
npm install airtable@0.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to a fixed version of the airtable package to address the issue.
Conclusion
The Machine-In-The-Middle vulnerability in airtable exposes sensitive information transmitted through the package to potential interception and decryption by attackers in a privileged network position. To mitigate this risk, it is crucial to upgrade to version 0.7.2 or later of the airtable package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airtable →
FAQ
This vulnerability allows attackers in a privileged network position to decrypt intercepted traffic, potentially exposing sensitive information transmitted through airtable.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this Machine-In-The-Middle vulnerability in airtable.
No, only versions prior to 0.7.2 of the airtable package are affected. It is crucial to upgrade to version 0.7.2 or later to mitigate the risk.
Yes, upgrading to version 0.7.2 or later of the airtable package will fix this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
No, there is no known workaround for this vulnerability. Upgrading to a fixed version of the airtable package is the only solution.
