CVE-2022-23646: Next Improper CSP Vulnerability
MODERATECVE-2022-23646 is a MODERATE (CVSS 5.9) improper csp vulnerability (CWE-451: User Interface (UI) Misrepresentation of Critical Information) affecting Next libraries in the npm ecosystem. The issue involves improper csp in image optimization api for next.js versions between 10.0.0 and 12.1.0. Remediation is available by upgrading affected packages to version 12.1.0.
CVE-2022-23646 at a Glance
Security Impact
CVSS: 5.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
How to Fix CVE-2022-23646
To remediate this vulnerability, upgrade all affected Next dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install next@12.1.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls nextHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2022-23646, inspect your project dependencies using npm:
npm ls nextAnalyze the terminal output to locate any version of Next in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 12.1.0), your application is affected.
Note: The npm ls next command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information, where the user interface (ui) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. this is often a component in phishing attacks. In Next, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-23646 Affected Next Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
next
|
npm |
≥ 10.0.0
< 12.1.0
|
12.1.0
|
References
Frequently Asked Questions
What is CVE-2022-23646?
Which Next versions are affected?
What version fixes CVE-2022-23646?
Is next affected?
What is the CVSS score of CVE-2022-23646?
What CWE is associated with CVE-2022-23646?
How can I check npm dependencies for CVE-2022-23646?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-fmvm-x8mv-47mj",
"modified" : "2022-02-23T15:26:32Z",
"published" : "2022-02-17T17:19:18Z",
"aliases" : [ "CVE-2022-23646" ],
"summary" : "Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0",
"details" : "Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.\n\n### Impact\n- **Affected**: All of the following must be true to be affected\n - Next.js between version 10.0.0 and 12.0.10\n - The `next.config.js` file has [images.domains](https://nextjs.org/docs/api-reference/next/image#domains) array assigned\n - The image host assigned in [images.domains](https://nextjs.org/docs/api-reference/next/image#domains) allows user-provided SVG\n- **Not affected**: The `next.config.js` file has [images.loader](https://nextjs.org/docs/api-reference/next/image#loader-configuration) assigned to something other than default\n\n### Patches\n[Next.js 12.1.0](https://github.com/vercel/next.js/releases/tag/v12.1.0)\n\n### Workarounds\nChange `next.config.js` to use a different [loader configuration](https://nextjs.org/docs/api-reference/next/image#loader-configuration) other than the default, for example:\n\n```js\nmodule.exports = {\n images: {\n loader: 'imgix',\n path: 'https://example.com/myaccount/',\n },\n}\n```\n\nOr if you want to use the [`loader`](https://nextjs.org/docs/api-reference/next/image#loader) prop on the component, you can use `custom`:\n```js\nmodule.exports = {\n images: {\n loader: 'custom',\n },\n}\n```\n\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "next"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "10.0.0"
}, {
"fixed" : "12.1.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mj"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-23646"
}, {
"type" : "WEB",
"url" : "https://github.com/vercel/next.js/pull/34075"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/vercel/next.js"
}, {
"type" : "WEB",
"url" : "https://github.com/vercel/next.js/releases/tag/v12.1.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-451" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2022-02-17T17:19:18Z",
"nvd_published_at" : "2022-02-17T21:15:00Z"
}
}