Description
The nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them.
Recommendation
Update the @finastra/nestjs-proxy package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.7.0
- Patched version(s): 0.7.0
References
Could your website be exposed too?
SmartScanner can check your website for Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy - CVE-2022-31069
- Exposure of Sensitive Information in simple-get - CVE-2022-0355
- Potential exposure of tokens to an Unauthorized Actor - CVE-2022-21671
- Exposure of Sensitive Information in eventsource - CVE-2022-1650
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023