CVE-2015-9238 Insecure Comparison in secure-compare
The secure-compare library fails to validate string equality correctly, allowing attackers to bypass security checks that rely on this comparison.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-9238?
CVE-2015-9238 is a medium-severity vulnerability in HackerOne secure-compare node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Which versions are affected by CVE-2015-9238?
2 open source packages ship an affected version, including secure-compare. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
secure-compare npm | All versions | 3.0.1 |
secure-compare npm | All versions | 3.0.1 |
Products include Secure-Compare Project Secure-Compare.
How do I fix CVE-2015-9238?
Upgrade secure-compare to 3.0.1 or later.
Is CVE-2015-9238 being exploited?
There is no known exploitation of CVE-2015-9238 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-h9x2-5rm7-x4gm.