What the vulnerability does
01Description
Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`. One may manually edit the app.js file post-build as a workaround.
Explanation of Vulnerability in Simple Terms
02Summary
Gatsby versions before 4.0.8 expose sensitive information that should not be publicly accessible. An attacker on the network can read this data without authentication or user interaction. The vulnerability affects the build output or runtime behavior of Gatsby sites. Update to version 4.0.8 or later to resolve the issue.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the Gatsby site without authentication.
Potential impact on your site
04Site Impact
Sensitive data may be exposed to anyone who can access your Gatsby site over the network.
Conditions required to exploit
05Prerequisites
Network access to the Gatsby site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 15, 2021
CVE published
August 3, 2024
Record updated
