CVE-2021-32770 Basic-auth app bundle credential exposure in gatsby-source-wordpress
The gatsby-source-wordpress plugin leaks HTTP Basic Authentication credentials into the client-side bundle when configured, exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32770?
CVE-2021-32770 is a high-severity vulnerability in gatsbyjs gatsby, published on 15 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. A patch has been introduced in [email protected] and [email protected] which mitigates the issue by filtering all variables specified in the `auth: { }` section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`. One may manually edit the app.js file post-build as a workaround.
Which versions are affected by CVE-2021-32770?
4 open source packages ship an affected version, including gatsby-source-wordpress. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gatsby-source-wordpress npm | All versions | 4.0.8 |
gatsby-source-wordpress npm | All versions | 4.0.8 |
gatsby-source-wordpress npm | From 5.0.0 | 5.9.2 |
gatsby-source-wordpress npm | From 5.0.0 | 5.9.2 |
Products include Gatsbyjs Gatsby-Source-Wordpress.
How do I fix CVE-2021-32770?
Upgrade gatsby-source-wordpress to a fixed version for your release line: 4.0.8 or 5.9.2.
Is CVE-2021-32770 being exploited?
There is no known exploitation of CVE-2021-32770 in the wild and no public exploit code.
Sources
Also known as GHSA-rqjw-p5vr-c695.