Executive brief
The Vrite SDK is a JavaScript library used by developers to integrate Vrite content management features into applications. A flaw in input validation allows attackers to send malicious or malformed data without proper sanitization, potentially compromising data integrity or causing service disruptions. Organizations using affected versions should upgrade to 0.3.0 or later.
Technical details
This vulnerability is classified as improper input validation (CWE-20) in the @vrite/sdk library affecting all versions prior to 0.3.0. The root cause involves insufficient validation of user-supplied input data, allowing attackers to send requests with unexpected or malicious payloads that bypass safety checks. The vulnerability is network-accessible and requires no authentication or special privileges. An attacker can exploit this to corrupt data, cause integrity issues, or trigger denial of service conditions. The fix was implemented in version 0.3.0 as documented in commit 1877683b932bb33fb20d688e476284b70bb9fe23, which restructured the backend and tightened CORS API access controls.
Affected products
- Vrite @vrite/sdk <0.3.0
Timeline
- 2023-10-13: disclosed: Vulnerability published on GitHub Security Advisory
- 2023-10-10: patched: Fix released in version 0.3.0