CVE-2022-31013
Critical
Description
Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function `this.authProvider.verifyAccessKey` is an async function, as the code is not using `await` to wait for the verification result. Every time the function responds back with success, along with an unhandled exception if the token is invalid. A patch is available in version 2.6.0.
SeverityCritical
CVSS9.1
Exploit probability—
ProductChat Server
PublishedMay 31, 2022
First seenMay 31, 2022
Weakness typeCWE-287Improper authentication
How to fix
Update
- chat_server_project chat_server2.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chat_server_project chat_server | 2.3.2 ≤ v < 2.6.0 | 2.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.