CSRF vulnerability in save-server

Description

Versions prior to version v1.05 are affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version v1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version.

This is patched by implementing Double submit.

Recommendation

Update the save-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.5
• Patched version(s): 1.0.7

References

• GHSA-wwrj-35w6-77ff
• medium.com
• www.npmjs.com
• CVE-2020-15135
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Firebase vulnerable to CRSF attack - CVE-2024-4128
• Cube API denial of service attack - CVE-2023-50709
• Prototype Pollution in protobufjs - CVE-2022-25878
• Cross-Site Scripting in highcharts - Vulnerability

Tags:

npm

save-server