Cache Deception Vulnerability in Better Call Package
Summary
GHSA-hq75-xg7r-rx6c: Better Call routing bug can lead to Cache Deception. Affects better-call versions < 1.0.12. Fixed in 1.0.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Better Call is an npm package designed to facilitate routing in applications, particularly those that require authentication and session management. It is often used in conjunction with other libraries, such as better-auth, to streamline user authentication processes. However, due to its reliance on CDN caching for static assets, it is susceptible to cache deception attacks, which can lead to unauthorized access to sensitive user data.
Vulnerability Detail
The vulnerability arises from insufficient path sanitization in the request processing logic of the Better Call library. Specifically, the library splits the request path using a base path configuration but fails to validate the remaining path components adequately. This oversight allows attackers to craft requests that appear to be legitimate static asset requests, which can bypass CDN cache exclusion rules. As a result, sensitive data may be served to unauthorized users, exposing user sessions and personal information.
How To Fix
Minimum fixed version
1.0.12
This is the first release that contains the fix.
npm install better-call@1.0.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling CDN caching for routes that handle sensitive data until you can update to the patched version. This can help mitigate the risk of cache deception attacks while you implement the necessary updates.
Conclusion
The Better Call package has a cache deception vulnerability that can expose sensitive user data due to insufficient path sanitization. It is crucial to update to version 1.0.12 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for vulnerabilities in your application.
See every vulnerability recorded for better-call →
FAQ
Cache deception is a type of attack where an attacker tricks a caching mechanism into serving sensitive data to unauthorized users by crafting requests that appear to be legitimate.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If exploited, this vulnerability can lead to unauthorized access to user sessions and personal data, compromising user privacy and security.
Yes, you can temporarily disable CDN caching for sensitive routes to reduce the risk of cache deception attacks until you can update to the patched version.
If an immediate update is not possible, implement the workaround by disabling CDN caching for affected routes and monitor your application for any suspicious activity.
