PT-2022-24942 · Unknown · @Keystone-6/Core

Austin Burdine · Published 2022-11-03 · Updated 2022-11-04 · CVE-2022-39382

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @keystone-6/core versions 3.0.0 through 3.0.1

Description The issue arises when NODE ENV is inlined to "development" for user code, regardless of the environment variables. This affects users who use NODE ENV to trigger security-sensitive functionality in their production builds. The application's dependencies, found in node modules, are typically not compiled and should be unaffected. The vulnerability has been fixed in @keystone-6/core@3.0.2.

Recommendations For @keystone-6/core versions 3.0.0 through 3.0.1, update to @keystone-6/core@3.0.2 to resolve the issue. As a temporary workaround, consider removing any code that uses NODE ENV in a way that may reasonably impact application security.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2022-39382

GHSA-25MX-2MXM-6343

Affected Products

@Keystone-6/Core

References · 10

• 🔥 https://github.com/keystonejs/keystone/security/advisories/GHSA-25mx-2mxm-6343 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39382.json · Exploit
• https://github.com/keystonejs/keystone/pull/8031 · Patch
• https://github.com/keystonejs/keystone/pull/8063 · Patch
• https://osv.dev/vulnerability/GHSA-25mx-2mxm-6343 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39382 · Security Note
• https://github.com/keystonejs/keystone · Note
• https://t.me/cibsecurity/52517 · Telegram Post
• https://t.me/cvenotify/36986 · Telegram Post