Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 3.1, published 27 July 2023.
- Which products and versions are affected?
- @saltcorn/cli (npm) SEMVER:introduced=0,fixed=0.8.8-beta.2; Saltcorn < 0.8.8.
- Is there a fix for This vulnerability?
- Yes. @saltcorn/cli (npm): upgrade to 0.8.8-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network.
- Am I affected?
- Check whether you run @saltcorn/cli (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @saltcorn/cli (npm): upgrade to 0.8.8-beta.2 or later
npm install @saltcorn/cli@0.8.8-beta.2
Technical details
The vulnerability is a privilege escalation and security-control bypass in the plugin installation mechanism. The root cause is that the safety check for "unsafe" plugins (which may access system resources or other tenant data) is performed against a tenant-controlled store configuration rather than the root server's approved plugin list. An attacker with tenant admin privileges can add a custom plugin store URL, import unapproved unsafe plugins via pack import, and install them despite server-level restrictions. The vulnerability requires high privileges (tenant admin role) and no user interaction. An attacker can execute arbitrary plugin code to exfiltrate data from other tenants or disrupt availability. A fix was merged in PR #1973 to check against the root-level configuration instead of the tenant store.
Affected products
- Saltcorn Saltcorn < 0.8.8
Timeline
- 2023-07-27: disclosed
- 2023-09-06: patched: Fix merged in PR #1973