Improper Authorization Affecting remult package, versions <0.20.6
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-REMULT-5725776
- published 21 Jun 2023
- disclosed 20 Jun 2023
- credit Unknown
Introduced: 20 Jun 2023
CVE-2023-35167 Open this link in a new tabHow to fix?
Upgrade remult to version 0.20.6 or higher.
Overview
remult is an A CRUD framework for full-stack TypeScript
Affected versions of this package are vulnerable to Improper Authorization such that when setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id. As a result, an attacker can gain read, update and delete access to an instance.
Note:
An attacker will need to prepare the attack by gaining access to an id of an entity instance he is not authorized to access.
Workaround
Users who are unable to upgrade to the fixed version can set the apiPrefilter option to a filter object instead of a function.