CVE-2023-39655

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-39655
A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts.

9.6 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-39655 Third Party Advisory
https://www.npmjs.com/package/%40perfood/couch-auth Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:perfood:couchauth:*:*:*:*:*:node.js:*:*
History

09 Jan 2024, 19:28

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de inyección de encabezado de host en las versiones del paquete NPM @perfood/couch-auth &lt;= 0.20.0. Al enviar un encabezado de host especialmente manipulado en la solicitud de contraseña olvidada, es posible enviar enlaces de restablecimiento de contraseña a los usuarios que, una vez que se hace clic en ellos, conducen a un servidor controlado por el atacante y, por lo tanto, filtran el token de restablecimiento de contraseña. Esto puede permitir que un atacante restablezca las contraseñas de otros usuarios y se apodere de sus cuentas.
References () https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-39655 - () https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-39655 - Third Party Advisory
References () https://www.npmjs.com/package/%40perfood/couch-auth - () https://www.npmjs.com/package/%40perfood/couch-auth - Product
CPE cpe:2.3:a:perfood:couchauth:*:*:*:*:*:node.js:*:*
First Time Perfood
Perfood couchauth
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.6
CWE CWE-74

03 Jan 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-03 13:15

Updated : 2024-01-09 19:28

NVD link : CVE-2023-39655

Mitre link : CVE-2023-39655

CVE.ORG link : CVE-2023-39655

JSON object : View

Products Affected

perfood

  • couchauth
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')