Incorrect Authorization in serverless-offline

Description

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).

Recommendation

No fix is available yet. Followings are affected versions:

• <= 8.0.0

References

• GHSA-h97f-5258-5593
• CVE-2021-38384
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Incorrect Authorization in @uppy/companion - CVE-2022-0528
• Incorrect sanitisation function leads to `XSS` in mermaid - CVE-2021-43861
• Cross-site Scripting in quill - CVE-2021-3163
• Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect - CVE-2024-30261

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

serverless-offline