Is CVE-2020-8176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-8176 being exploited in the wild.

How severe is CVE-2020-8176?

Low severity, with a CVSS score of 3.1, published 17 May 2021.

Which products and versions are affected?

@shopify/koa-shopify-auth (npm) SEMVER:introduced=3.1.61,fixed=3.1.63; Shopify Koa-Shopify-Auth 3.1.61–3.1.62.

Is there a fix for CVE-2020-8176?

Yes. @shopify/koa-shopify-auth (npm): upgrade to 3.1.63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-8176 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-8176?

Check whether you run @shopify/koa-shopify-auth (npm) or Shopify Koa-Shopify-Auth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-8176: Shopify koa-shopify-auth cross-site scripting in auth endpoint

CVE-2020-8176 · Severity: low · CVSS 3.1 · Published 2021-05-17

Shopify's koa-shopify-auth is a library used by Node.js applications to handle authentication with Shopify's API. A cross-site scripting (XSS) vulnerability in versions 3.1.61–3.1.62 allows attackers to inject malicious JavaScript code via the shop parameter on the authentication endpoint, potentially stealing session tokens or performing unauthorized actions on behalf of authenticated users.

Vendors: npm, Shopify.

Quick answers

Is CVE-2020-8176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-8176 being exploited in the wild.
How severe is CVE-2020-8176?: Low severity, with a CVSS score of 3.1, published 17 May 2021.
Which products and versions are affected?: @shopify/koa-shopify-auth (npm) SEMVER:introduced=3.1.61,fixed=3.1.63; Shopify Koa-Shopify-Auth 3.1.61–3.1.62.
Is there a fix for CVE-2020-8176?: Yes. @shopify/koa-shopify-auth (npm): upgrade to 3.1.63 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-8176 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-8176?: Check whether you run @shopify/koa-shopify-auth (npm) or Shopify Koa-Shopify-Auth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@shopify/koa-shopify-auth (npm): upgrade to 3.1.63 or later
```
npm install @shopify/koa-shopify-auth@3.1.63
```

Technical details

A reflected cross-site scripting vulnerability (CWE-79) exists in koa-shopify-auth versions 3.1.61 through 3.1.62 on the /shopify/auth/enable_cookies endpoint. The vulnerability stems from insufficient input validation of the shop parameter, which is reflected into the response without proper encoding. An attacker can craft a malicious URL containing JavaScript payloads in the shop parameter that executes in a victim's browser when clicked. User interaction (clicking a link) is required for exploitation. The vulnerability was fixed in version 3.1.63 via input sanitization changes merged in the upstream Shopify/quilt repository.

Affected products

Shopify koa-shopify-auth 3.1.61–3.1.62

Identifiers

CVE-2020-8176
GHSA-jqh7-w5pr-cr56

Timeline

2020-07-02: disclosed: NVD publication date
2020-05-23: patched: Fix merged in upstream repository
2021-05-17: advisory: GHSA advisory published

References

https://github.com/Shopify/quilt/pull/1455

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.