CVE-2023-35167 When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
Attackers can bypass API filters to read, update, or delete unauthorized data by ID if apiPrefilter is set to a function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-35167?
CVE-2023-35167 is a medium-severity missing authorization vulnerability in remult, published on 23 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.
Weakness: CWE-284
Which versions are affected by CVE-2023-35167?
2 open source packages ship an affected version, including remult. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
remult npm | All versions | 0.20.6 |
remult npm | All versions | 0.20.6 |
Products include Remult Remult.
How do I fix CVE-2023-35167?
Upgrade remult to 0.20.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-35167 being exploited?
There is no known exploitation of CVE-2023-35167 in the wild and no public exploit code.
Sources
Also known as GHSA-7hh3-3x64-v2g9.