Is CVE-2021-27884 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-27884 being exploited in the wild.

How severe is CVE-2021-27884?

Low severity, with a CVSS score of 3.1, published 26 March 2021.

Which products and versions are affected?

yapi-vendor (npm) SEMVER:introduced=0,fixed=1.9.3; Ymfe Yapi <= 1.9.2.

Is there a fix for CVE-2021-27884?

Yes. yapi-vendor (npm): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-27884 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2021-27884?

Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-27884: YMFE YApi weak JWT secret generation in yapi-vendor

Q: Is there a fix for CVE-2021-27884?

Yes. yapi-vendor (npm): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2021-27884 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2021-27884?

Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-27884 · Severity: low · CVSS 3.1 · Published 2021-03-26

YMFE YApi is an API management platform. A vulnerability in how it generates security tokens allows an attacker to potentially predict and recreate login tokens for other users. This could lead to unauthorized access to the platform and sensitive API documentation.

Technologies: yapi-vendor (npm), Ymfe Yapi. Vendors: npm, Ymfe.

Quick answers

Is CVE-2021-27884 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-27884 being exploited in the wild.
How severe is CVE-2021-27884?: Low severity, with a CVSS score of 3.1, published 26 March 2021.
Which products and versions are affected?: yapi-vendor (npm) SEMVER:introduced=0,fixed=1.9.3; Ymfe Yapi <= 1.9.2.
Is there a fix for CVE-2021-27884?: Yes. yapi-vendor (npm): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-27884 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2021-27884?: Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

yapi-vendor (npm): upgrade to 1.9.3 or later
```
npm install yapi-vendor@1.9.3
```

Technical details

The yapi-vendor package (used by YApi) utilizes Node.js's Math.random() to generate the 'passsalt' string, which serves as the secret for signing JSON Web Tokens (JWT). Because Math.random() is a cryptographically insecure pseudo-random number generator (PRNG) based on the XorShift128+ algorithm, its internal state can be recovered by observing a sequence of outputs. An attacker can register multiple accounts to observe consecutive tokens, recover the PRNG state, and then brute-force or predict the signing secrets for other users' tokens. This vulnerability is fixed in version 1.9.3 by using a cryptographically secure random source.

Affected products

YMFE yapi-vendor <= 1.9.2

Identifiers

CVE-2021-27884
GHSA-2h3h-vw8r-82rp

Timeline

2020-11-18: disclosed: Report sent to maintainer
2021-03-01: advisory: NVD published date
2021-03-26: patched: GHSA published and fix confirmed in 1.9.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.