Vulnerability · Published May 25, 2022 · Assigned by GitHub_M

CVE-2022-31004Potential secrets being logged to disk in CVE Services

High 7.5

In plain English

A high-severity security flaw in cve-services from CVEProject. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.0%top 37.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not development. If this method were called in production, it is possible that it would write the plaintext key to disk. A patch is not available as of time of publication but is anticipated as a "hot fix" for version 1.1.1 and for the 2.x branch.

Affected products (as reported)

Vendor	Product	Versions
CVEProject	cve-services	<= 1.1.1

Weakness: CWE-779 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/CVEProject/cve-services/security/advisories/GHSA-mpwm-rmqp-7629 x_refsource_CONFIRM
https://github.com/CVEProject/cve-services/blob/6b085e481fd3b084a8828ef7489c6b82fa415c92/src/utils/data.js#L68-L83 x_refsource_MISC