PT-2022-12971 · Keystone · Keystone

Published 2022-01-11 · Updated 2022-01-18 · CVE-2022-0087

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions keystone versions prior to 1.0.2

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This can impact users of the administration user interface when following an untrusted link to the signin or init page. It is a targeted attack that may present itself in the form of phishing and can be chained with other vulnerabilities.

Recommendations For versions prior to 1.0.2, please upgrade to @keystone-6/auth >= 1.0.2 to resolve the issue. If upgrading is not possible, consider disabling the administration user interface as a temporary workaround. Alternatively, if using a reverse-proxy, strip query parameters when accessing the administration interface to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0087

GHSA-HRGX-7J6V-XJ82

Affected Products

Keystone

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0087.json · Exploit
• 🔥 https://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e · Exploit
• https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0087 · Security Note
• https://osv.dev/vulnerability/GHSA-hrgx-7j6v-xj82 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0087 · Vendor Advisory
• https://github.com/keystonejs/keystone · Note
• https://github.com/keystonejs/keystone/security/advisories/GHSA-hrgx-7j6v-xj82 · Note
• https://t.me/cvenotify/25273 · Telegram Post
• https://t.me/cibsecurity/35316 · Telegram Post