Quick answers
- Is CVE-2023-2307 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-2307 being exploited in the wild.
- How severe is CVE-2023-2307?
- Low severity, with a CVSS score of 3, published 26 April 2023.
- Which products and versions are affected?
- Builder.Io Qwik-City prior to 0.104.0; @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=0.104.0.
- Is there a fix for CVE-2023-2307?
- Yes. @builder.io/qwik-city (npm): upgrade to 0.104.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-2307 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2023-2307?
- Check whether you run Builder.Io Qwik-City or @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @builder.io/qwik-city (npm): upgrade to 0.104.0 or later
npm install @builder.io/qwik-city@0.104.0
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in @builder.io/qwik-city that stems from improper handling of relative protocol URLs, which could bypass CSRF protections. Specifically, URLs with a relative protocol (e.g., "//attacker.com") were not properly validated, allowing attackers to craft malicious requests. The attack requires user interaction (the victim must click a malicious link or visit a malicious page) but is network-based with no authentication required. An attacker can cause the victim's browser to make unintended requests to the vulnerable application. The vulnerability was fixed in version 0.104.0 released on 2023-04-26.
Affected products
- Builder.io qwik-city prior to 0.104.0
Identifiers
- CVE-2023-2307
- GHSA-c54w-7j5f-xg98
Timeline
- 2023-04-26: disclosed
- 2023-04-26: patched: Fixed in version 0.104.0