EverShop at risk to unauthorized access via weak HMAC secret

Description

An issue was discovered in NPM’s package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as “secret”.

Recommendation

Update the @evershop/evershop package to the latest compatible version. Followings are version details:

Affected version(s): < 1.0.0-rc.9
Patched version(s): 1.0.0-rc.9

References

GHSA-32r3-57hp-cgfw
advisory.checkmarx.net
devhub.checkmarx.com
CVE-2023-46943
CWE-284
CWE-798
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6
OWASP 2021-A7

Could your website be exposed too?

SmartScanner can check your website for EverShop at risk to unauthorized access via weak HMAC secret and gives you actionable findings to investigate.

Start a free scan

Related Issues

EverShop is vulnerable to Unauthorized Order Information Access (IDOR) - CVE-2025-12919
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API - CVE-2025-67419
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API - CVE-2025-67427
Directory Traversal in evershop - @evershop/evershop - GHSA-4wrm-qmq2-5fjx - CVE-2023-46493

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated November 18, 2024