Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
CVE-2021-38384 - Critical Severity Vulnerability
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-6.8.0.tgz
Path to dependency file: /utility-emissions-channel/typescript_app/package.json
Path to vulnerable library: /utility-emissions-channel/typescript_app/node_modules/serverless-offline/package.json
Dependency Hierarchy: - serverless-s3-local-0.6.7.tgz (Root Library) - :x: **serverless-offline-6.8.0.tgz** (Vulnerable Library)
Found in HEAD commit: d388e16464e00b9ce84df0d247029f534a429b90
Found in base branch: main
Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Publish Date: 2021-08-10
URL: CVE-2021-38384
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-38384
Release Date: 2021-08-10
Fix Resolution (serverless-offline): 8.1.0
Direct dependency fix Resolution (serverless-s3-local): 0.6.8
Step up your Open Source Security Game with Mend here