Executive brief
TinaCMS is a popular headless CMS that stores content in GitHub repositories. The CLI tool inadvertently wrote sensitive search API tokens to the tina-lock.json lock file, which could be committed to public repositories. An attacker gaining access to this file could use the leaked token to query the search index without authorization, potentially exposing or manipulating indexed content.
Technical details
The @tinacms/cli package with versions prior to 1.6.2 incorrectly includes search configuration containing API tokens in the tina-lock.json lock file during the build process. The vulnerability stems from insufficient filtering of sensitive configuration fields before serializing the lock file. The attack vector is network-based with no authentication or user interaction required; an attacker only needs access to the lock file (commonly stored in version control). The vulnerability allows confidentiality breach through token theft and unauthorized search API access. The fix was released in @tinacms/cli@1.6.2, which filters out search configuration from the lock file output. Users must upgrade and rotate their search tokens immediately.
Affected products
- TinaCMS @tinacms/cli < 1.6.2
Timeline
- 2024-09-03: disclosed: Vulnerability published as GHSA-4qrm-9h4r-v2fx and CVE-2024-45391
- 2024-09-03: patched: Fix released in @tinacms/cli@1.6.2