PT-2024-13391 · Npm · @Evershop/Evershop

Published 2024-01-12 · Updated 2024-08-30 · CVE-2023-46943

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @evershop/evershop versions prior to 1.0.0-rc.8

Description An issue was discovered in NPM's package @evershop/evershop where the HMAC secret used for generating tokens is hardcoded as "secret". This poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.

Recommendations For versions prior to 1.0.0-rc.8, update to version 1.0.0-rc.8 or later to resolve the issue. As a temporary workaround, consider regenerating the HMAC secret with a secure, randomly generated value to prevent attackers from creating valid JSON Web Tokens (JWTs).

Fix

Improper Access Control

Using Hardcoded Credentials

Weakness Enumeration

CWE-284

CWE-798

Related Identifiers

CVE-2023-46943

GHSA-32R3-57HP-CGFW

Affected Products

@Evershop/Evershop

References · 12

• https://osv.dev/vulnerability/GHSA-32r3-57hp-cgfw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46943 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46943 · Vendor Advisory
• https://github.com/evershopcommerce/evershop · Note
• https://github.com/evershopcommerce/evershop/commit/96d9ca3e024e0b63c538911e4a914df3d287cc9f · Note
• https://twitter.com/CVEnew/status/1745998021106544676 · Twitter Post
• https://twitter.com/Checkmarx/status/1808870879905911234 · Twitter Post
• https://advisory.checkmarx.net/advisory/CVE-2023-46943 · Note
• https://t.me/cvenotify/67354 · Telegram Post
• https://t.me/cvenotify/92904 · Telegram Post
• https://devhub.checkmarx.com/cve-details/CVE-2023-46943 · Note
• https://t.me/cvenotify/87461 · Telegram Post