GHSA-724c-6vrf-99rq Sensitive Data Exposure in loopback
Attackers can retrieve sensitive user data from the login endpoint via invalid requests, potentially aiding credential theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-724c-6vrf-99rq?
GHSA-724c-6vrf-99rq is a vulnerability in loopback, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of loopback prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.
Recommendation
If you're using loopback 3.x upgrade to version 3.26.0 or later.
If you're using loopback 2.x upgrade to version 2.42.0 or later.
Which versions are affected by GHSA-724c-6vrf-99rq?
4 open source packages ship an affected version, including loopback.
| Package | Affected | Fixed in |
|---|---|---|
loopback npm | All versions | 2.42.0 |
loopback npm | All versions | 2.42.0 |
loopback npm | From 3.0.0 | 3.26.0 |
loopback npm | From 3.0.0 | 3.26.0 |
How do I fix GHSA-724c-6vrf-99rq?
Upgrade loopback to a fixed version for your release line: 2.42.0 or 3.26.0.
Is GHSA-724c-6vrf-99rq being exploited?
There is no known exploitation of GHSA-724c-6vrf-99rq in the wild and no public exploit code.