What is the CVSS score of CVE-2022-39382?

CVE-2022-39382 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Is there a public PoC exploit available for CVE-2022-39382?

Yes, a public proof-of-concept exploit is available for CVE-2022-39382. Prioritise patching immediately. EPSS: 1.5%.

Is there a patch available for CVE-2022-39382?

Yes, a patch is available for CVE-2022-39382. Update the affected software to the latest version immediately.

Node.js CVE-2022-39382

CRITICAL

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2022-11-03 security-advisories@github.com

Information Disclosure Node.js Keystone

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 03, 2022 - 14:15 nvd

CRITICAL 9.8

DescriptionNVD

Keystone is a headless CMS for Node.js - built with GraphQL and React.@keystone-6/core@3.0.0 || 3.0.1 users that use NODE_ENV to trigger security-sensitive functionality in their production builds are vulnerable to NODE_ENV being inlined to "development" for user code, irrespective of what your environment variables. If you do not use NODE_ENV in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use NODE_ENV to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured NODE_ENV variable. The application's dependencies, as found in node_modules (including @keystone-6/core), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that NODE_ENV=production yarn keystone start still uses secure cookies when using statelessSessions. This vulnerability has been fixed in @keystone-6/core@3.0.2, regression tests have been added for this vulnerability in #8063.

AnalysisAI

Keystone is a headless CMS for Node.js - built with GraphQL and React.@keystone-6/core@3.0.0 || 3.0.1 users that use NODE_ENV to trigger security-sensitive functionality in their production. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-74. Keystone is a headless CMS for Node.js - built with GraphQL and React.@keystone-6/core@3.0.0 || 3.0.1 users that use NODE_ENV to trigger security-sensitive functionality in their production builds are vulnerable to NODE_ENV being inlined to "development" for user code, irrespective of what your environment variables. If you do not use NODE_ENV in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use NODE_ENV to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured NODE_ENV variable. The application's dependencies, as found in node_modules (including @keystone-6/core), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that NODE_ENV=production yarn keystone start still uses secure cookies when using statelessSessions. This vulnerability has been fixed in @keystone-6/core@3.0.2, regression tests have been added for this vulnerability in #8063. Affected products include: Keystonejs Keystone.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.