Executive brief
The Airtable npm package had SSL certificate validation unintentionally disabled by default, allowing attackers on the network to intercept and decrypt traffic between applications and Airtable's servers. This affects any application using the vulnerable library to communicate with Airtable, potentially exposing API keys, authentication tokens, and sensitive business data. The vulnerability was fixed in version 0.7.2.
Technical details
The Airtable npm package contained a man-in-the-middle (MITM) vulnerability caused by SSL certificate validation being disabled by default. This is a cryptographic failure (CWE-295: Improper Certificate Validation) that affects all versions from 0.1.19 through 0.7.1. An attacker positioned on the network path between an application and Airtable's servers could intercept HTTPS traffic and decrypt communications without requiring authentication from the application itself. This could expose API credentials, bearer tokens, and sensitive data transferred to/from Airtable. The issue was resolved by enabling certificate validation by default in version 0.7.2.
Affected products
- Airtable airtable 0.1.19 to 0.7.1
Timeline
- 2020-09-03: disclosed
- 2020-08-31: patched: Fixed in version 0.7.2