@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization.
This issue is fixed in versions 1.13.1 and 1.14.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
grpc:grpc-node
References 6
https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2
https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2
https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99…
https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4
https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e040…
https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f
https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c…
https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75
https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1
https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1
https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1
https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1