CVE-2017-16570 Information

Description

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value aka SecureLayer7 issue number SL7_KEYJS_03. In other words it fails to reject requests that lack an x-csrf-token header.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report/ https://github.com/keystonejs/keystone/issues/4437 https://github.com/keystonejs/keystone/pull/4478 https://www.exploit-db.com/exploits/43922/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8