CVE-2021-38384 Incorrect Authorization in serverless-offline
Serverless Offline returns 403 for trailing slashes unlike AWS, potentially leading developers to implement incorrect access controls and bypass security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38384?
CVE-2021-38384 is a critical missing authorization vulnerability in n/a, published on 10 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Weakness: CWE-755
Which versions are affected by CVE-2021-38384?
2 open source packages ship an affected version, including serverless-offline. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
serverless-offline npm | All versions to 8.0.0 | None |
serverless-offline npm | All versions to 8.0.0 | None |
Products include Serverless Offline Project Serverless Offline.
How do I fix CVE-2021-38384?
No fix has been published for CVE-2021-38384 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-38384 being exploited?
There is no known exploitation of CVE-2021-38384 in the wild and no public exploit code.
Sources
Also known as GHSA-h97f-5258-5593.