Ssl Certificate
Monthly
Insecure file permissions in Quasar's development TLS certificate utility (@quasar/ssl-certificate before 2.1.0, shipped via @quasar/cli before 5.0.4 and @quasar/app-vite before 3.3.0) let another local, unprivileged user on the same host read the cached combined private key and certificate PEM and then impersonate the developer's localhost HTTPS endpoint in any environment that trusts that certificate. The flaw is a local, low-privilege information-disclosure and impersonation issue (CWE-732) rather than a remotely exploitable critical condition: it only matters on multi-user, non-Windows machines (shared workstations, CI/build servers, container hosts) where at least one other local account exists and the generated dev certificate is actually trusted. Additional weaknesses compound the exposure - the generated certificate was CA-capable, carried unnecessary key usages, and encoded the IPv6 loopback address as a DNS SAN - but the practical impact remains bounded by the local-attacker prerequisite; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this CVE. Vendor-released fixes are available in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4 and @quasar/app-vite 3.3.0.
Insecure file permissions in Quasar's development TLS certificate utility (@quasar/ssl-certificate before 2.1.0, shipped via @quasar/cli before 5.0.4 and @quasar/app-vite before 3.3.0) let another local, unprivileged user on the same host read the cached combined private key and certificate PEM and then impersonate the developer's localhost HTTPS endpoint in any environment that trusts that certificate. The flaw is a local, low-privilege information-disclosure and impersonation issue (CWE-732) rather than a remotely exploitable critical condition: it only matters on multi-user, non-Windows machines (shared workstations, CI/build servers, container hosts) where at least one other local account exists and the generated dev certificate is actually trusted. Additional weaknesses compound the exposure - the generated certificate was CA-capable, carried unnecessary key usages, and encoded the IPv6 loopback address as a DNS SAN - but the practical impact remains bounded by the local-attacker prerequisite; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this CVE. Vendor-released fixes are available in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4 and @quasar/app-vite 3.3.0.