CVE-2021-32624
📋 TL;DR
Keystone 5 CMS has an access control bypass vulnerability that allows attackers to extract private field values through query infrastructure manipulation. This affects all Keystone 5 deployments using private fields or lists with read access controls. Attackers can use this as an oracle attack to gradually reveal sensitive information they shouldn't have access to.
💻 Affected Systems
- Keystone 5
📦 What is this software?
Keystone 5 by Keystonejs
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of all private field data including sensitive user information, credentials, or proprietary business data stored in private fields.
Likely Case
Partial exposure of private field metadata and some field values, enabling attackers to gather intelligence about system structure and potentially extract sensitive information.
If Mitigated
Limited information leakage through timing or error-based side channels, but no direct data exposure if proper network segmentation and monitoring are in place.
🎯 Exploit Status
Attack requires understanding of Keystone query infrastructure and involves iterative oracle attacks to extract information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/keystonejs/keystone-5/security/advisories/GHSA-27g8-r9vw-765x
Restart Required: No
Instructions:
No official patch available. Monitor Keystone security advisories for updates.
🧯 If You Can't Patch
- Consider migrating sensitive data out of Keystone private fields to more secure storage solutions.
- Implement strict network access controls and monitoring for Keystone instances.
🔍 How to Verify
Check if Vulnerable:
Check if you're running Keystone 5 with private fields or lists configured.Check Version:
Check package.json for keystone version or run: npm list keystoneVerify Fix Applied:
No fix available to verify.📡 Detection & Monitoring
Log Indicators:
- Unusual query patterns to private fields
- Multiple failed access attempts followed by successful queries
- Abnormal timing in query responses
Network Indicators:
- Repeated similar queries with slight variations
- Unusual query parameter patterns
SIEM Query:
Look for patterns of repeated GraphQL queries with field enumeration attempts