Executive brief
Keystone, a popular Node.js content management system and web framework, contains a flaw in its default login system. An attacker who knows a user's password can successfully log in even if they only provide a partial or incomplete email address. This could allow unauthorized access to administrative accounts if an attacker can guess or obtain passwords and use shortened versions of target email addresses.
Technical details
A vulnerability in the default sign-in functionality of the Keystone node module (prior to version 0.3.16) allows for a partial authentication bypass. The root cause is a bug in the email matching logic where incomplete email addresses are incorrectly validated against the database. While a correct password is still required for authentication, an attacker can gain access by providing only a substring or partial match of a valid user's email address. This is reachable over the network without prior authentication. The issue was addressed in version 0.3.16.
Affected products
- KeystoneJS keystone < 0.3.16
Timeline
- 2015-01-01: other: Vulnerability identified (based on CVE year)
- 2018-05-29: disclosed: NVD Published Date
- 2018-06-07: advisory: GitHub Advisory published