CVE-2020-7764: Web Cache Poisoning in find-my-way
5.9
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.75689%
CWE
Published
11/9/2020
Updated
1/9/2023
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| find-my-way | npm | < 2.2.5 | 2.2.5 |
| find-my-way | npm | >= 3.0.0, < 3.0.5 | 3.0.5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from find-my-way's default handling of the 'Accept-Version' header via the deriveVersion function in lib/accept-version.js. Before patches, this function was always active, parsing the header even when no versioned routes existed. This allowed attackers to inject malicious headers that would be cached (as they weren't part of the cache key), leading to web cache poisoning. The GitHub commit ab40835 shows the fix involved making versioning opt-in - deriveVersion only activates when versioned routes exist. In vulnerable versions, this function's unconditional header parsing created the attack surface.