GitHub Advisoryadvisory · npm
GHSA-53mj-mc38-q894 Remote Memory Exposure in openwhisk
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- openwhisk
- Severity
- Moderate
- Reviewed
- 2020-08-31
Affected packages
• npm openwhisk: < 3.3.1 → fixed in 3.3.1
Description
Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure.
When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).
Proof of concept:
```js
var openwhisk = require('openwhisk');
var options = {
apihost: '127.0.0.1:1433',
api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
```
Recommendation
Update to version 3.3.1 or later.