CVE-2017-16225 Github Token Leak in aegir
The aegir module inadvertently exposed user GitHub tokens in published npm packages, allowing attackers to steal credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16225?
CVE-2017-16225 is a high-severity vulnerability in HackerOne aegir node module, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
Weakness: CWE-200
Which versions are affected by CVE-2017-16225?
2 open source packages ship an affected version, including aegir. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aegir npm | From 12.0.0 | 12.0.8 |
aegir npm | From 12.0.0 | 12.0.8 |
Products include Aegir Project Aegir.
How do I fix CVE-2017-16225?
Upgrade aegir to 12.0.8 or later.
Is CVE-2017-16225 being exploited?
There is no known exploitation of CVE-2017-16225 in the wild and no public exploit code.
Other vulnerabilities in HackerOne aegir node module
Sources
Also known as GHSA-6xhf-x49c-m5m6.