Information Disclosure in @keystonejs/keystone (CVE-2021-32624)
Summary
Vulnerability in @keystonejs/keystone (CVE-2021-32624). Successful exploitation can lead to full system takeover. Exploitable via read.
Original description
The description as published by the source.
This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control.
This is an access control related oracle attack in that the attack method guides an attacker during their attempt to reveal information they do not have access to. The complexity of completing the attack is limited by some length-dependent behaviors and the fidelity of the exposed information.
Impact
Under some circumstances, field values or field value meta data can be determined, despite the field or list having read access control configured. If you use private fields or lists, you may be impacted.
Patches
None, at this time
Workarounds
None, at this time
References
None
For more information
For the protection of the community and private deployments, we think that the best course of action will be to not disclose further details on any open GitHub issues related to this advisory until a hot-fix or work-around has been deployed or published.
If needed, you can email us at keystone@thinkmill.com.au
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2021-32624 has been found in @keystonejs/keystone.
Attackers can target a specific entry point like read over the network to misuse the product.
Successful exploitation can lead to full system takeover.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "@keystonejs/keystone CVE-2021-32624" on the vendor's site.
CVE-2021-32624 (@keystonejs/keystone) — CWE-200
Attack vector: remote (network-reachable) / no user interaction
Attack surface: read
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Information disclosure (CWE-200) exists in @keystonejs/keystone. Attackers reach the vulnerable code path via read.
Check the vendor advisory for the affected versions of @keystonejs/keystone. Attack surface: read.
Severity: ?. Successful exploitation can lead to full system takeover.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r '@keystonejs/keystone' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r '@keystonejs/keystone' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
@keystonejs/keystoneを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- web github.com