GitHub Advisory Databaseの情報
10月24日(土)昨日
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
影響: npm:@azure/msal-node >= 5.0.0-beta.0, < 7.1.0 → 7.1.0 Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth_code to to acquireTokenByCode
10月21日(水)
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
影響: npm:uploadfs >= 1.25.0, < 1.28.0 → 1.28.0 When uploadfs is configured with the Azure backend and sas: true (a supported configuration introduced in uploadfs 1.25.0), createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, getUrl() returns a base URL carrying the complete account/container SAS signature (?sv=...&sig=...), and Apostrophe's attachment.url() prepends it to every public attachment link — broadcasting a…