Generation of Error Message Containing Sensitive Information in zsa

Description

All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths.

Recommendation

Update the zsa package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.3.3
• Patched version(s): 0.3.3

References

• GHSA-wjmj-h3xc-hxp8
• CVE-2024-37162
• CWE-209
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262
• react-native-mmkv Insertion of Sensitive Information into Log File vulnerability - CVE-2024-21668
• Modified package published to npm, containing malware that exfiltrates private key material - CVE-2024-54134
• Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - @strapi/strapi - CVE-2022-30617

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

zsa