GHSA-4j6x-w426-6rc6 Default Express middleware security check is ignored in production
Attackers can bypass authentication in Cube.js deployments using default Express middleware in production, potentially accessing protected data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-4j6x-w426-6rc6?
GHSA-4j6x-w426-6rc6 is a missing authorization vulnerability in @cubejs-backend/api-gateway, published on 8 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Default Express middleware security check is ignored in production
Impact
All Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default express authentication middleware in production environment are affected.
Patches
@cubejs-backend/[email protected]
Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/cube-js/cube.js/issues
- Reach out us in community Slack: https://slack.cube.dev/
Which versions are affected by GHSA-4j6x-w426-6rc6?
2 open source packages ship an affected version, including @cubejs-backend/api-gateway.
| Package | Affected | Fixed in |
|---|---|---|
@cubejs-backend/api-gateway npm | From 0.11.0 | 0.11.17 |
@cubejs-backend/api-gateway npm | From 0.11.0 | 0.11.17 |
How do I fix GHSA-4j6x-w426-6rc6?
Upgrade @cubejs-backend/api-gateway to 0.11.17 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-4j6x-w426-6rc6 being exploited?
There is no known exploitation of GHSA-4j6x-w426-6rc6 in the wild and no public exploit code.