Vulnerability-Lookup

CNVD-2022-85044

Vulnerability from cnvd - Published: 2022-12-05

Title

Airtable.js配置错误漏洞

Description

Airtable.js是Airtable开源的一个Airtable javascript客户端。提供了一种访问数据的简单方法。 Airtable.js 0.11.6之前版本存在配置错误漏洞，该漏洞源于脚本中存在错误配置，当脚本运行时，它会将环境变量绑定到编译包的构建目标中。攻击者可利用此漏洞将本地用户构建Airtable.js修改为包含AIRTABLE_API_KEY环境变量的值，并在打包代码中附带该值。

Severity

中

Patch Name

Airtable.js配置错误漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://github.com/Airtable/airtable.js/pull/330/commits/b468d8fe48d75e3d5fe46d0ea7770f4658951ed0

Reference

https://github.com/Airtable/airtable.js/security/advisories/GHSA-vqm5-9546-x25v

Impacted products

Name
Airtable Airtable.js <0.11.6

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-46155",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-46155"
    }
  },
  "description": "Airtable.js\u662fAirtable\u5f00\u6e90\u7684\u4e00\u4e2aAirtable javascript\u5ba2\u6237\u7aef\u3002\u63d0\u4f9b\u4e86\u4e00\u79cd\u8bbf\u95ee\u6570\u636e\u7684\u7b80\u5355\u65b9\u6cd5\u3002\n\nAirtable.js 0.11.6\u4e4b\u524d\u7248\u672c\u5b58\u5728\u914d\u7f6e\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u811a\u672c\u4e2d\u5b58\u5728\u9519\u8bef\u914d\u7f6e\uff0c\u5f53\u811a\u672c\u8fd0\u884c\u65f6\uff0c\u5b83\u4f1a\u5c06\u73af\u5883\u53d8\u91cf\u7ed1\u5b9a\u5230\u7f16\u8bd1\u5305\u7684\u6784\u5efa\u76ee\u6807\u4e2d\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5c06\u672c\u5730\u7528\u6237\u6784\u5efaAirtable.js\u4fee\u6539\u4e3a\u5305\u542bAIRTABLE_API_KEY\u73af\u5883\u53d8\u91cf\u7684\u503c\uff0c\u5e76\u5728\u6253\u5305\u4ee3\u7801\u4e2d\u9644\u5e26\u8be5\u503c\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1ahttps://github.com/Airtable/airtable.js/pull/330/commits/b468d8fe48d75e3d5fe46d0ea7770f4658951ed0",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-85044",
  "openTime": "2022-12-05",
  "patchDescription": "Airtable.js\u662fAirtable\u5f00\u6e90\u7684\u4e00\u4e2aAirtable javascript\u5ba2\u6237\u7aef\u3002\u63d0\u4f9b\u4e86\u4e00\u79cd\u8bbf\u95ee\u6570\u636e\u7684\u7b80\u5355\u65b9\u6cd5\u3002\r\n\r\nAirtable.js 0.11.6\u4e4b\u524d\u7248\u672c\u5b58\u5728\u914d\u7f6e\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u811a\u672c\u4e2d\u5b58\u5728\u9519\u8bef\u914d\u7f6e\uff0c\u5f53\u811a\u672c\u8fd0\u884c\u65f6\uff0c\u5b83\u4f1a\u5c06\u73af\u5883\u53d8\u91cf\u7ed1\u5b9a\u5230\u7f16\u8bd1\u5305\u7684\u6784\u5efa\u76ee\u6807\u4e2d\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5c06\u672c\u5730\u7528\u6237\u6784\u5efaAirtable.js\u4fee\u6539\u4e3a\u5305\u542bAIRTABLE_API_KEY\u73af\u5883\u53d8\u91cf\u7684\u503c\uff0c\u5e76\u5728\u6253\u5305\u4ee3\u7801\u4e2d\u9644\u5e26\u8be5\u503c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Airtable.js\u914d\u7f6e\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Airtable Airtable.js \u003c0.11.6"
  },
  "referenceLink": "https://github.com/Airtable/airtable.js/security/advisories/GHSA-vqm5-9546-x25v",
  "serverity": "\u4e2d",
  "submitTime": "2022-11-30",
  "title": "Airtable.js\u914d\u7f6e\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2022-46155 (GCVE-0-2022-46155)

Vulnerability from cvelistv5 – Published: 2022-11-29 00:00 – Updated: 2025-04-23 16:33

Title

Airtable.js credentials exposed in browser builds

Summary

Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build script is run, it would bundle environment variables into the build target of a transpiled bundle. Specifically, the AIRTABLE_API_KEY and AIRTABLE_ENDPOINT_URL environment variables are inserted during Browserify builds due to being referenced in Airtable.js code. This only affects copies of Airtable.js built from its source, not those installed via npm or yarn. Airtable API keys set in users’ environments via the AIRTABLE_API_KEY environment variable may be bundled into local copies of Airtable.js source code if all of the following conditions are met: 1) the user has cloned the Airtable.js source onto their machine, 2) the user runs the `npm prepare` script, and 3) the user' has the AIRTABLE_API_KEY environment variable set. If these conditions are met, a user’s local build of Airtable.js would be modified to include the value of the AIRTABLE_API_KEY environment variable, which could then be accidentally shipped in the bundled code. Users who do not meet all three of these conditions are not impacted by this issue. Users should upgrade to Airtable.js version 0.11.6 or higher; or, as a workaround unset the AIRTABLE_API_KEY environment variable in their shell and/or remove it from your .bashrc, .zshrc, or other shell configuration files. Users should also regenerate any Airtable API keys they use, as the keysy may be present in bundled code.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 15:46 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Airtable/airtable.js/security/…
https://github.com/Airtable/airtable.js/pull/330/…
https://github.com/Airtable/airtable.js/releases/…

Impacted products

1 product

Vendor	Product	Version
Airtable	airtable.js	Affected: < 0.11.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:24:03.340Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Airtable/airtable.js/security/advisories/GHSA-vqm5-9546-x25v"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Airtable/airtable.js/pull/330/commits/b468d8fe48d75e3d5fe46d0ea7770f4658951ed0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Airtable/airtable.js/releases/tag/v0.11.6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-46155",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:46:18.626194Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:33:50.650Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "airtable.js",
          "vendor": "Airtable",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build script is run, it would bundle environment variables into the build target of a transpiled bundle. Specifically, the AIRTABLE_API_KEY and AIRTABLE_ENDPOINT_URL environment variables are inserted during Browserify builds due to being referenced in Airtable.js code. This only affects copies of Airtable.js built from its source, not those installed via npm or yarn. Airtable API keys set in users\u2019 environments via the AIRTABLE_API_KEY environment variable may be bundled into local copies of Airtable.js source code if all of the following conditions are met: 1) the user has cloned the Airtable.js source onto their machine, 2) the user runs the `npm prepare` script, and 3) the user\u0027 has the AIRTABLE_API_KEY environment variable set. If these conditions are met, a user\u2019s local build of Airtable.js would be modified to include the value of the AIRTABLE_API_KEY environment variable, which could then be accidentally shipped in the bundled code. Users who do not meet all three of these conditions are not impacted by this issue. Users should upgrade to Airtable.js version 0.11.6 or higher; or, as a workaround unset the AIRTABLE_API_KEY environment variable in their shell and/or remove it from your .bashrc, .zshrc, or other shell configuration files. Users should also regenerate any Airtable API keys they use, as the keysy may be present in bundled code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-29T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/Airtable/airtable.js/security/advisories/GHSA-vqm5-9546-x25v"
        },
        {
          "url": "https://github.com/Airtable/airtable.js/pull/330/commits/b468d8fe48d75e3d5fe46d0ea7770f4658951ed0"
        },
        {
          "url": "https://github.com/Airtable/airtable.js/releases/tag/v0.11.6"
        }
      ],
      "source": {
        "advisory": "GHSA-vqm5-9546-x25v",
        "discovery": "UNKNOWN"
      },
      "title": "Airtable.js credentials exposed in browser builds"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-46155",
    "datePublished": "2022-11-29T00:00:00.000Z",
    "dateReserved": "2022-11-28T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:33:50.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted