search

larksuite / node-sdk

larksuite open sdk for nodejs
MIT License
131 stars 26 forks source link

Fix Cross-Site Request Forgery value is disclosed to an unauthorised actor #73

Open lamrecognitions opened 5 months ago

lamrecognitions commented 5 months ago

An issue found in project larksuite/node-sdk used axios .8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information. 

  const instance = axios.create({
    withCredentials: true,
  });
    const cookies = new Cookies();
    cookies.set("XSRF-TOKEN", "whatever", {
      domain: "localhost",
      sameSite: "strict",
    });
    instance
      .get("https://www.com")
      .then((res) => console.log(res.data))
      .catch((err) => console.error(err.message));
lib/adapters/xhr.js:191
const xsrfValue = (config.withCredentials || isURLSameOrigin(fullPath))

CVE-2023-45857 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N