Homepage About Snyk

DNS Rebinding Affecting github.com/99designs/aws-vault/server Open this link in a new tab package, versions >=5.0.0 <5.4.4 >=4.0.0 <4.7.2

0.0
medium

  • Attack Complexity

    Low

  • User Interaction

    Required

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-GOLANG-GITHUBCOM99DESIGNSAWSVAULTSERVER-568165

  • published

    7 May 2020

  • disclosed

    5 May 2020

  • credit

    philsnow

Report a new vulnerability Found a mistake?

Introduced: 5 May 2020

CWE-350 Open this link in a new tab

How to fix?

Upgrade github.com/99designs/aws-vault/server to version 5.4.4, 4.7.2 or higher.

Overview

github.com/99designs/aws-vault/server is a vault for securely storing and accessing AWS credentials in development environments.

Affected versions of this package are vulnerable to DNS Rebinding. With the aws-vault EC2 metadata service running, it's possible for an attacker controlling any web page the victim visits with javascript enabled to mount a DNS rebinding attack to grab short-lived credentials from the aws-vault server.