N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8g98-m4j9-qww5

GHSA-8g98-m4j9-qww5: Taylored webhook validation vulnerabilities

Critical Security Advisory for Taylored npm package v7.0.7 - tag 7.0.5

Summary

A series of moderate to high-severity security vulnerabilities have been identified specifically in version 7.0.7 of `taylored`. These vulnerabilities reside in the "Backend-in-a-Box" template distributed with this version. They could allow a malicious actor to read arbitrary files from the server, download paid patches without completing a valid purchase, and weaken the protection of encrypted patches.

All users who have installed or generated a `taysell-server` using version 7.0.7 of `taylored` are strongly advised to immediately upgrade to version 7.0.8 (or later) and follow the required mitigation steps outlined below. Versions prior to 7.0.7 did not include the Taysell functionality and are therefore not affected by these specific issues.

Vulnerabilities Patched in v7.0.8

Version 7.0.8 addresses the following issues found in the v7.0.7 template:

Path Traversal in Patch Download: The patch download endpoint did not properly sanitize the user-provided `patchId`. An attacker could have crafted a request with path traversal sequences (e.g., `../../etc/passwd`) to read arbitrary files from the server's filesystem. The `patchId` is now sanitized to ensure only files within the intended patches directory can be accessed.
Missing PayPal Webhook Validation: The server endpoint did not cryptographically verify incoming payment notifications, allowing an attacker to spoof a purchase and gain unauthorized access to patches.
Purchase Token Replay Vulnerability: A legitimate purchase token could be reused indefinitely. The system now correctly invalidates tokens after their first use.
Insufficient PBKDF2 Iterations: The key derivation function used an insufficient number of iterations, making encrypted patches more susceptible to brute-force attacks. This has been strengthened.

Required Actions

To fix these vulnerabilities, users of version 7.0.7 must upgrade the `taylored` tool and regenerate their `taysell-server` instance.

Miggo Vulnerability Database

→

GHSA-8g98-m4j9-qww5

GHSA-8g98-m4j9-qww5:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
taylored	npm	>= 7.0.5, < 7.0.8	7.0.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerabilities reside in the 'Backend-in-a-Box' template (taysell-server) generated by taylored version 7.0.7. The analysis of the commit 57b7634391959dbbdb39b387ac4dc68157cd58a1 and the security advisory GHSA-8g98-m4j9-qww5 reveals several issues:

Path Traversal: The /get-patch endpoint in templates/backend-in-a-box/index.js did not sanitize the patchId parameter, allowing arbitrary file reads. The vulnerable code pattern involved the direct use of patchId in path.join.
Missing Webhook Validation: The /paypal/webhook endpoint in templates/backend-in-a-box/index.js did not verify the signature of incoming PayPal webhooks, allowing attackers to spoof purchase completion events. The patch added cryptographic verification.
Token Replay: The /get-patch endpoint allowed reuse of purchase tokens as it lacked a mechanism to mark tokens as used. The patch introduced the token_used_at field and corresponding checks.
Insufficient PBKDF2 Iterations: Both the patch encryption function (encryptAES256GCM in lib/taysell-utils.ts) and the decryption function (decryptAES256GCM in templates/backend-in-a-box/index.js) used a low PBKDF2 iteration count (100,000), weakening the encryption. The patch increased this to 310,000.

The identified functions are the direct handlers of malicious input or perform cryptographic operations with weakened parameters. These functions would appear in runtime profiles or stack traces during exploitation or when processing affected data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.