Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-3956

CVE-2016-3956:
npm Token Leak in npm

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2016-3956
GHSA ID
GHSA-m5h6-hr3q-22h5
EPSS Score
0.84318%
CWE
CWE-200
Published
7/31/2018
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
npmnpm<= 2.15.02.15.1
npmnpm>= 3.0.0, <= 3.8.23.8.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from npm CLI sending bearer tokens to all HTTP endpoints. The key functions identified are:

  1. mapToRegistry: Directly responsible for resolving registry URLs and attaching credentials. Pre-patch versions lacked host validation (fixed via scopeAuth helper in commits f67ecad/fea8cc9).
  2. getCredentialsByURI: Provided credentials without context-aware filtering. The 'alwaysAuth' logic was applied too broadly before registry host validation checks were added. The commit diffs show critical changes to these functions, including the introduction of host-matching logic and credential scoping.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*****t** v*rsions o* t** `npm` p**k*** in*lu** t** ***r*r tok*n o* t** lo**** in us*r in *v*ry r*qu*st m*** *y t** *LI, *v*n i* t** r*qu*st is not *ir**t** tow*r*s t** us*r's **tiv* r**istry. *n *tt**k*r *oul* *r**t* *n *TTP s*rv*r to *oll**t tok*n

Reasoning

T** vuln*r**ility st*mm** *rom npm *LI s*n*in* ***r*r tok*ns to *ll *TTP *n*points. T** k*y *un*tions i**nti*i** *r*: *. m*pToR**istry: *ir**tly r*sponsi*l* *or r*solvin* r**istry URLs *n* *tt***in* *r***nti*ls. Pr*-p*t** v*rsions l**k** *ost v*li**t