GHSA-vc4h-q48j-5hcx: Npm/payload vulnerability
Impact
Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.
The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Add a beforeDuplicate field hook to fields and set the value to empty or your default value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Configuration
Add a beforeDuplicate field hook to fields and set the duplicated value to empty or your default value.
Payload fields beforeDuplicate = empty or the default value
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Payload's duplicate operation are exposed when duplicated source documents contain fields that are hidden or whose access.read or access.create rules should prevent the caller from receiving or setting their values. Auth collections are also affected despite disableDuplicate being enabled by default for those collections.
What must an attacker be able to do to obtain restricted field values?
The caller needs access to use the duplicate operation on a source document. The vulnerable operation can copy values from fields even when the relevant read or create access rule would reject those values for that caller.
What can be done if upgrading is not immediately possible?
Add a beforeDuplicate field hook to affected fields and set the value to empty or to an appropriate default value. Upgrade Payload packages to version 3.90.0 or later, or 4.0.0-canary.34 or later, when possible.