Is CVE-2021-32091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-32091 being exploited in the wild.

How severe is CVE-2021-32091?

Low severity, with a CVSS score of 3.1, published 7 May 2021.

Which products and versions are affected?

localstack (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.6.1, ECOSYSTEM:introduced=0,last_affected=0.12.10.

Is there a fix for CVE-2021-32091?

Yes. localstack (PyPI): upgrade to 0.12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-32091 attacked?

It is attacked over the network.

Am I affected by CVE-2021-32091?

Check whether you run localstack (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32091: PYSEC-2021-102 - A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.

CVE-2021-32091 · Severity: low · CVSS 3.1 · Published 2021-05-07

LocalStack is a popular open-source AWS cloud emulator used by developers to test cloud applications locally. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that execute in the browsers of developers using LocalStack, potentially bypassing security protections and enabling further attacks on the local instance.

Technologies: localstack (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-32091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-32091 being exploited in the wild.
How severe is CVE-2021-32091?: Low severity, with a CVSS score of 3.1, published 7 May 2021.
Which products and versions are affected?: localstack (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.6.1, ECOSYSTEM:introduced=0,last_affected=0.12.10.
Is there a fix for CVE-2021-32091?: Yes. localstack (PyPI): upgrade to 0.12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32091 attacked?: It is attacked over the network.
Am I affected by CVE-2021-32091?: Check whether you run localstack (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

localstack (PyPI): upgrade to 0.12.6.1 or later
```
pip install "localstack>=0.12.6.1"
```

Technical details

The vulnerability is a reflected or stored cross-site scripting (CWE-79) in LocalStack's web interface. The XSS flaw allows an attacker to inject unescaped JavaScript code that executes in a victim's browser when they interact with LocalStack. Because LocalStack explicitly allows cross-origin requests by setting permissive CORS headers (Access-Control-Allow-Origin: *), this XSS vulnerability can be chained with other attacks to bypass browser same-origin protections. An attacker can craft a malicious website that tricks a developer into visiting it; the XSS payload executes in the context of the developer's LocalStack instance, enabling further exploitation such as CSRF-based configuration manipulation to inject proxy backdoors. No authentication is required since LocalStack is designed for local development environments.

Affected products

LocalStack LocalStack 0.12.10 and earlier

Identifiers

CVE-2021-32091
GHSA-37m5-42qp-4qpr
PYSEC-2021-102

Timeline

2021-05-07: disclosed: Published by NVD
2021-06-18: advisory: GitHub Security Advisory published

References

https://blog.sonarsource.com/hack-the-stack-with-localstack

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.