Improper Authorization in googleapis
Summary
GHSA-7543-mr7h-6v86: Improper Authorization in googleapis. Affects googleapis versions < 39.1.0. Fixed in 39.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The googleapis package is an npm package that provides a set of client libraries for interacting with various Google APIs. It allows developers to easily integrate their applications with Google services such as Google Cloud, Google Drive, and Google Calendar. The package is widely used in Node.js applications for accessing Google APIs.
Vulnerability Detail
Versions of googleapis prior to 39.1.0 are vulnerable to Improper Authorization. This vulnerability arises from a flaw where setting credentials to one client may apply to all clients, causing requests to be sent with incorrect credentials. This can lead to unauthorized access to sensitive data or actions on behalf of the affected user. The vulnerability has a severity rating of HIGH and is classified under CWE-285.
How To Fix
Minimum fixed version
39.1.0
This is the first release that contains the fix.
npm install googleapis@39.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the googleapis package prior to version 39.1.0 is vulnerable to Improper Authorization. It is crucial to upgrade to the latest version to ensure that credentials are correctly applied to individual clients and to mitigate the risk of unauthorized access to sensitive data or actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for googleapis →
FAQ
This vulnerability can result in unauthorized access to sensitive data or actions on behalf of the affected user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time alerts for open-source vulnerabilities.
No, only versions prior to 39.1.0 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerability.
No specific workaround is mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-7543-mr7h-6v86/GHSA-7543-mr7h-6v86.json
