GHSA-8wgc-jjvv-cv6v Improper Authorization in loopback
Attackers can create authentication tokens for any user if the AccessToken model is exposed, leading to unauthorized data access and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-8wgc-jjvv-cv6v?
GHSA-8wgc-jjvv-cv6v is a missing authorization vulnerability in loopback, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will allow the attacker to access the user's data and their privileges.
Recommendation
For loopback 2.x, upgrade to version 2.40.0 or later For loopback 3.x, upgrade to version 3.22.0 or later
Which versions are affected by GHSA-8wgc-jjvv-cv6v?
4 open source packages ship an affected version, including loopback.
| Package | Affected | Fixed in |
|---|---|---|
loopback npm | All versions | 2.40.0 |
loopback npm | All versions | 2.40.0 |
loopback npm | From 3.0.0 | 3.22.0 |
loopback npm | From 3.0.0 | 3.22.0 |
How do I fix GHSA-8wgc-jjvv-cv6v?
Upgrade loopback to a fixed version for your release line: 2.40.0 or 3.22.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-8wgc-jjvv-cv6v being exploited?
There is no known exploitation of GHSA-8wgc-jjvv-cv6v in the wild and no public exploit code.