MEDIUM4.3

GHSA-r385-c5fc-x56c

CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

Details

A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@perfood/couch-auth

Introduced in: 0

No fixed version published yet for @perfood/couch-auth (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-57177[ADVISORY]
https://github.com/perfood/couch-auth[PACKAGE]
https://github.com/waristea/cve-research/tree/main/CVE-2024-57177[WEB]