PT-2023-18155 · Nuxtlabs · Nuxtlabs/Github-Module

Published 2023-04-18 · Updated 2023-04-27 · CVE-2023-2138

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nuxtlabs/github-module versions prior to 1.6.2

Description The issue involves the use of hard-coded credentials in the GitHub repository nuxtlabs/github-module. A hardcoded GitHub token was found in the source code, which had access to multiple repositories under the nuxt, nuxtlabs, and nuxt-themes GitHub organizations.

Recommendations For versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the repositories that were accessible by the hardcoded token until the update is applied.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-2138

GHSA-FP2W-G92G-FGQ4

Affected Products

Nuxtlabs/Github-Module

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2138.json · Exploit
• https://github.com/nuxtlabs/github-module/commit/5490c43f729eee60f07920bf88c0aabdc1398b6e · Patch
• https://osv.dev/vulnerability/GHSA-fp2w-g92g-fgq4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2138 · Security Note
• https://github.com/nuxtlabs/github-module · Note
• https://github.com/nuxtlabs/github-module/releases/tag/v1.6.2 · Note
• https://t.me/cibsecurity/62336 · Telegram Post
• https://huntr.dev/bounties/65096ef9-eafc-49da-b49a-5b88c0203ca6 · Note
• https://t.me/cvenotify/48486 · Telegram Post