CVE-2022-31070 : What You Need to Know

This article provides details about CVE-2022-31070, a vulnerability in the @finastra/nestjs-proxy npm package that could lead to sensitive cookie exposure.

Understanding CVE-2022-31070

CVE-2022-31070 is a vulnerability in the NestJS Proxy module of the npm package @finastra/nestjs-proxy that could potentially expose sensitive cookies to unauthorized actors.

What is CVE-2022-31070?

The vulnerability in the @finastra/nestjs-proxy npm package prior to version 0.7.0 could allow sensitive cookies, such as session cookies, to be inadvertently exposed to backend services, posing a risk of unauthorized access to sensitive information.

The Impact of CVE-2022-31070

The impact of CVE-2022-31070 is rated as medium severity with high confidentiality and integrity impacts. It requires high privileges and user interaction for exploitation, with low attack complexity and a local attack vector.

Technical Details of CVE-2022-31070

This section outlines the technical details surrounding the vulnerability.

Vulnerability Description

Prior to version 0.7.0, the @finastra/nestjs-proxy package lacked the ability to block sensitive cookies from being forwarded to backend services, potentially exposing them to unauthorized actors.

Affected Systems and Versions

The vulnerability affects versions of @finastra/nestjs-proxy prior to 0.7.0.

Exploitation Mechanism

Exploiting this vulnerability requires high privileges and user interaction with low attack complexity and a local attack vector.

Mitigation and Prevention

To mitigate the risks associated with CVE-2022-31070, immediate and long-term security measures should be implemented.

Immediate Steps to Take

Users are strongly advised to update their @finastra/nestjs-proxy package to version 0.7.0 or higher to prevent sensitive cookie exposure.

Long-Term Security Practices

Developers should implement a secure cookie handling mechanism and regularly update packages to avoid similar vulnerabilities in the future.

Patching and Updates

Ensure regular updates and monitoring of security advisories to stay informed about patches and updates related to the @finastra/nestjs-proxy package.