PT-2021-22098 · Unknown · Serverless Offline

Published 2021-08-10 · Updated 2022-07-12 · CVE-2021-38384

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serverless Offline version 8.0.0

Description The issue arises when Serverless Offline returns a 403 HTTP status code for a route with a trailing / character, potentially leading to incorrect access control implementation by developers. This discrepancy occurs because the actual behavior in the Amazon AWS environment results in a 200 HTTP status code, indicating possibly greater than expected permissions.

Recommendations For Serverless Offline version 8.0.0, consider reviewing and adjusting access control configurations to account for the difference in HTTP status code responses between the local development environment and the Amazon AWS environment. As a temporary workaround, developers should be cautious when implementing access control based on the local development environment's behavior, ensuring that the actual permissions in the AWS environment are thoroughly understood and correctly configured.

Exploit

Fix

Incorrect Authorization

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-863

CWE-755

Related Identifiers

CVE-2021-38384

GHSA-H97F-5258-5593

Affected Products

Serverless Offline

References · 6

• 🔥 https://github.com/dherault/serverless-offline/issues/1259 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38384 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38384 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h97f-5258-5593 · Vendor Advisory
• https://github.com/dherault/serverless-offline · Note
• https://t.me/cvenotify/19009 · Telegram Post