GHSA-jcjx-c3j3-44pr Insufficient Session Expiration in @cyyynthia/tokenize
Attackers can use tokens that never expire due to a generation bug, bypassing session expiration controls in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-jcjx-c3j3-44pr?
GHSA-jcjx-c3j3-44pr is a vulnerability in @cyyynthia/tokenize, published on 10 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
A bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the lastTokenReset field.
Patches
Version 1.1.3 contains a patch that'll invalidate these faulty tokens and make new ones behave as expected.
Workarounds
None. Tokens do not hold the necessary information to perform invalidation anymore.
References
PR #1
For more information
If you have any questions or comments about this advisory:
- Open an issue in github.com/cyyynthia/tokenize
- Email us at [email protected]
Which versions are affected by GHSA-jcjx-c3j3-44pr?
2 open source packages ship an affected version, including @cyyynthia/tokenize.
| Package | Affected | Fixed in |
|---|---|---|
@cyyynthia/tokenize npm | From 1.1.0 | 1.1.3 |
@cyyynthia/tokenize npm | From 1.1.0 | 1.1.3 |
How do I fix GHSA-jcjx-c3j3-44pr?
Upgrade @cyyynthia/tokenize to 1.1.3 or later.
Is GHSA-jcjx-c3j3-44pr being exploited?
There is no known exploitation of GHSA-jcjx-c3j3-44pr in the wild and no public exploit code.