CVE-2023-34247: @keystone-6/auth Open Redirect vulnerability
Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the @keystone-6/auth package.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@keystone-6/authto a version that resolves this vulnerability.Patch pull request 8626 - Compensating control
Avoid using the @keystone-6/auth package (versions 7.0.0 and prior) to mitigate the open redirect vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-34247?
The severity of CVE-2023-34247 is considered high due to the potential for open redirect attacks.
How do I fix CVE-2023-34247?
To fix CVE-2023-34247, update the @keystone-6/auth package to version 7.0.1 or later.
Which versions of Keystone are affected by CVE-2023-34247?
CVE-2023-34247 affects Keystone versions 7.0.0 and prior.
What are the risks associated with CVE-2023-34247?
The risks include exposure to phishing attacks as users can be redirected to malicious domains.
How can I identify if my application is vulnerable to CVE-2023-34247?
You can identify the vulnerability by checking if your application uses a version of the @keystone-6/auth package that is 7.0.0 or earlier.