CVE-2022-39382 NODE_ENV in Keystone defaults to development with esbuild
Keystone CMS inlines NODE_ENV as development, potentially bypassing security checks in user code that rely on this variable for production behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39382?
CVE-2022-39382 is a critical vulnerability in keystonejs keystone, published on 3 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/[email protected] || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development"` for user code, irrespective of what your environment variables. If you do not use `NODE_ENV` in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use `NODE_ENV` to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured `NODE_ENV` variable. The application's dependencies, as found in `node_modules` (including `@keystone-6/core`), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that `NODE_ENV=production yarn keystone start` still uses secure cookies when using `statelessSessions`. This vulnerability has been fixed in @keystone-6/[email protected], regression tests have been added for this vulnerability in #8063.
Weakness: CWE-74
Which versions are affected by CVE-2022-39382?
2 open source packages ship an affected version, including @keystone-6/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@keystone-6/core npm | From 3.0.0 | 3.0.2 |
@keystone-6/core npm | From 3.0.0 | 3.0.2 |
Products include Keystonejs Keystone.
How do I fix CVE-2022-39382?
Upgrade @keystone-6/core to 3.0.2 or later.
Is CVE-2022-39382 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39382 exists.
Other vulnerabilities in keystonejs keystone
- CVE-2022-29354 File upload in n/a
- CVE-2022-39322 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field
- CVE-2017-16570 Cross-Site Request Forgery (CSRF) in keystone
- CVE-2017-15879 Keystone is vulnerable to CSV injection
- CVE-2015-9240 Authentication Weakness in keystone
Sources
Also known as GHSA-25mx-2mxm-6343.