Executive brief
LoopBack is a popular Node.js framework for building REST APIs and backend applications. A vulnerability in the AccessToken model allows attackers to create authentication tokens for any user if the model is publicly exposed, potentially compromising user accounts and enabling unauthorized access to sensitive data and user privileges.
Technical details
The vulnerability is an improper authorization flaw (CWE-285) in the LoopBack AccessToken model. If the AccessToken model is publicly exposed in the API, an attacker who knows a target user's userId can create valid authentication tokens for that user without proper authorization checks. This attack requires network access to the API endpoint but no pre-authentication from the attacker. Successful exploitation grants the attacker full access to the compromised user's data and privileges. The fix is to upgrade to LoopBack 2.40.0 or later for 2.x versions, or 3.22.0 or later for 3.x versions.
Affected products
- StrongLoop LoopBack < 2.40.0 (2.x branch) and < 3.22.0 (3.x branch)
Timeline
- 2020-09-02: disclosed
- 2020-08-31: patched: Security advisories released for versions 2.40.0 and 3.22.0