Junglewise Threat Intelligence

CVE-2022-39382: KeystoneJS @keystone-6/core incorrect NODE_ENV inlining via esbuild

CVE-2022-39382 · Severity: low · CVSS 3.1 · Published 2022-11-03

Executive brief

KeystoneJS is a headless content management system (CMS) used to manage website data and APIs. A configuration issue in certain versions causes the system to incorrectly identify itself as being in a 'development' mode even when deployed in a 'production' environment. This could lead to the accidental exposure of sensitive debugging information or the bypass of security checks that are only active in production mode.

Technical details

A vulnerability exists in @keystone-6/core versions 3.0.0 and 3.0.1 where the build process, utilizing esbuild, defaults the NODE_ENV environment variable to 'development' because the platform configuration is undefined. This causes user-authored TypeScript code to have 'development' inlined as a constant, even in production builds. If developers use NODE_ENV checks to gate security-sensitive functionality (e.g., disabling authentication or enabling verbose error reporting in dev), those checks will fail to protect the production environment. This issue specifically affects user code rather than third-party dependencies in node_modules. The vulnerability is resolved in version 3.0.2 by correctly configuring the esbuild platform.

Affected products

  • KeystoneJS @keystone-6/core 3.0.0, 3.0.1

Timeline

  • 2022-10-23: patched: Fix merged in pull request 8031
  • 2022-11-03: advisory: GitHub Advisory GHSA-25mx-2mxm-6343 published
  • 2022-11-03: disclosed: CVE-2022-39382 published to NVD

References

Related threats