CVE-2022-31069: Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy
First published: Wed Jun 15 2022(Updated: )
NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them. A new feature has been introduced in the patched version of nestjs-proxy that allows application developers to opt out of forwarding the Authorization headers on a per service basis using the `forwardToken` config setting. Developers are advised to review the README for this library on Github or NPM for further details on how this configuration can be applied. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Finastra Nestjs-proxy | <0.7.0 | |
| NestJS Proxy | <=0.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-31069?
CVE-2022-31069 has a severity rating that indicates a potential security risk due to improper handling of Authorization headers.
How do I fix CVE-2022-31069?
To fix CVE-2022-31069, upgrade the nestjs-proxy library to version 0.7.0 or later.
What versions are affected by CVE-2022-31069?
CVE-2022-31069 affects versions of the nestjs-proxy library prior to 0.7.0 and up to 0.4.0.
What type of vulnerability is CVE-2022-31069?
CVE-2022-31069 is a security vulnerability related to improper authorization header forwarding.
Who is impacted by CVE-2022-31069?
Developers using the affected versions of the nestjs-proxy library in their applications are impacted by CVE-2022-31069.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/title
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/finastra
- canonical/finastra nestjs-proxy
- vendor/nestjs-proxy project
- canonical/nestjs proxy
- version/nestjs proxy/0.4.0