Vulnerability-Lookup

GHSA-9QPJ-QQ2R-5MCC

Vulnerability from github – Published: 2023-05-26 13:52 – Updated: 2023-05-26 13:52

Summary

html inputs of type password recorded in plaintext when converted to text inputs

Details

Impact

Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs. A customer may assume that switching to type="text" would also not record this input; hence, they would not add additional highlight-mask css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a Show Password button is used.

Patches

highlight.run@6.0.0 resolves the issue via https://github.com/rrweb-io/rrweb/pull/1184 This patch tracks changes to the type attribute of an input to ensure an input that used to be a type="password" continues to be obfuscated.

Workarounds

We have deployed a change to our data ingest to obfuscate passwords server side from older clients. This means that upgrading to the latest version of highlight.run is not necessary but recommended to prevent potential network transfer of recorded password data to our backend.

References

https://github.com/rrweb-io/rrweb/pull/1184

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "highlight.run"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-33187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-319"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-26T13:52:19Z",
    "nvd_published_at": "2023-05-26T21:15:20Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nHighlight may record passwords on customer deployments when a password html input is switched to `type=\"text\"` via a javascript \"Show Password\" button. This differs from the expected behavior which always obfuscates `type=\"password\"` inputs. A customer may assume that switching to `type=\"text\"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used.\n\n### Patches\n`highlight.run@6.0.0` resolves the issue via https://github.com/rrweb-io/rrweb/pull/1184\nThis patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type=\"password\"` continues to be obfuscated. \n\n### Workarounds\nWe have deployed a change to our data ingest to obfuscate passwords server side from older clients.\nThis means that upgrading to the latest version of highlight.run is not necessary but recommended to prevent potential network transfer of recorded password data to our backend.\n\n### References\nhttps://github.com/rrweb-io/rrweb/pull/1184\n",
  "id": "GHSA-9qpj-qq2r-5mcc",
  "modified": "2023-05-26T13:52:19Z",
  "published": "2023-05-26T13:52:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33187"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rrweb-io/rrweb/pull/1184"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/highlight/highlight"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "html inputs of type password recorded in plaintext when converted to text inputs"
}

CVE-2023-33187 (GCVE-0-2023-33187)

Vulnerability from cvelistv5 – Published: 2023-05-26 20:11 – Updated: 2025-01-14 19:30

Title

highlight vulnerable to cleartext transmission of sensitive information

Summary

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `type="password"` inputs. A customer may assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0. This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type="password"` continues to be obfuscated.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CWE

CWE-319 - Cleartext Transmission of Sensitive Information

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/highlight/highlight/security/a…	x_refsource_CONFIRM
https://github.com/rrweb-io/rrweb/pull/1184	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
highlight	highlight	Affected: < 6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:39:35.715Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc"
          },
          {
            "name": "https://github.com/rrweb-io/rrweb/pull/1184",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rrweb-io/rrweb/pull/1184"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-33187",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-14T19:30:51.170909Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-14T19:30:59.002Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "highlight",
          "vendor": "highlight",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type=\"text\"` via a javascript \"Show Password\" button. This differs from the expected behavior which always obfuscates `type=\"password\"` inputs. A customer may assume that switching to `type=\"text\"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0.\nThis patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type=\"password\"` continues to be obfuscated. \n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-26T20:11:54.507Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc"
        },
        {
          "name": "https://github.com/rrweb-io/rrweb/pull/1184",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rrweb-io/rrweb/pull/1184"
        }
      ],
      "source": {
        "advisory": "GHSA-9qpj-qq2r-5mcc",
        "discovery": "UNKNOWN"
      },
      "title": "highlight vulnerable to cleartext transmission of sensitive information"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-33187",
    "datePublished": "2023-05-26T20:11:54.507Z",
    "dateReserved": "2023-05-17T22:25:50.697Z",
    "dateUpdated": "2025-01-14T19:30:59.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-9QPJ-QQ2R-5MCC

Impact

Patches

Workarounds

References

CVE-2023-33187 (GCVE-0-2023-33187)

Tags

Sightings

Nomenclature